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FOREWORD 


This is one of a set of seven reports, each one describing the 
results, for a particular subsystem, of a study titled "An Engineering 
Study of Onboard Checkout Techniques. " Under the general title of 
"A Guide to Onboard Checkout, " the reports are as follows. 


Volume 

IBM Number 

Subsystem 

I 

71W-00308 

Guidance, Navigation and Control 

II 

71W-00309 

Environmental Control and Life 
Support 

III 

71W-00310 

Electrical Power 

IV 

71W-00311 

Propulsion 

V 

71W-00312 

Data Management 

VI 

71W-00313 

Structures/Mechanical 

VII 

71W-00314 

R.F. Communications 

This set of guides was prepared from the results of a nine month 
"Engineering Study of Onboard Checkout Techniques" (NAS9-11189) 
performed under NASA contract by the IBM Federal Systems Division 


at its Space Systems facility in Huntsville, Alabama, with the support 
of the McDonnell Douglas Astronautics Company Western Division, 
Huntington Beach, California. 

Technical monitor for the study was Mr. L. Marion Pringle, Jr. 
of the NASA Manned Spacecraft Center. The guidance and support 
given to the study by him and by other NASA personnel are gratefully 
acknowledged. 
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Section 1 


INTRODUCTION 


1.1 OBJECTIVE 


With the advent of large scale aerospace systems, designers have recognized 
the importance of specifying and meeting design requirements additional to the 
classical functional and environmental requirements. These "additional" require- 
ments include producibility, safety, reliability, quality, and maintainability. 

These criteria have been identified, grown into prominence, and become disciplines 
in their own right. Presently, it is inconceivable that any aerospace system/ 
equipment design requirements would be formulated without consideration of 
these criteria. 

The complexity, sophistication and duration of future manned space missions 
demand that still another criterion needs to be considered in the formulation of 
system/equipment requirements. The concept of "checkoutability" denotes the 
adaptability of a system, subsystem, or equipment to a controlled checkout pro- 
cess. As with other requirements, it should also apply from the time of early 
design concept formulation. 

The results of "An Engineering Study of Onboard Checkout Techniques" and 
other studies indicate that for an extended space mission onboard checkout is 
mandatory and applicable to all subsystems of the space system. In order to use 
it effectively, "checkoutability" should be incorporated into the design of each 
subsystem, beginning with initial performance requirements. 

Conferences with researchers, system engineers and subsystem specialists 
in the course of the basic Onboard Checkout Techniques Study revealed an extensive 
interest in the idea of autonomous onboard checkout. Designers are motivated to 
incorporate "checkoutability" into their subsystem designs but express a need for 
information and guidance that will enable them to do so efficiently. 

It is the objective of this report to present the results of the basic study as 
they relate to one space subsystem to serve as a guide, by example, to those who 
in the future need to implement onboard checkout in a similar subsystem. It is not 
practicable to formulate a firm set of instructions or recipes, because operational 
requirements, which vary widely among systems, normally determine the check- 
out philosophy. It is suggested that the reader study this report as a basis from 
which to build his own approach to "checkoutability. ” 
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1.2 BASIC STUDY SUMMARY 
1. 2. 1 STUDY OBJECTIVE 

The basic study was aimed at identification and evaluation of techniques for 
achieving the following capabilities in the operational Space Station/Base, under 
control of the Data Management System (DMS), with minimal crew intervention. 

• Automated failure prediction and detection 

• Automated fault isolation 

• Failure correction 

• Onboard electronic maintenance 

1.2.2 STUDY BASELINE 

The study started in July 1970. The system design baseline was established 
by the Space Station Phase B study results as achieved by the McDonnell-Douglas/ 
IBM team, modified in accordance with technical direction from NASA-MSC. The 
overall system configuration was the 33-foot diameter, four-deck, 12-man station. 
Individual subsystem baseline descriptions are given in their respective "Guide to 
Onboard Checkout" reports. 

1.2.3 STUDY TASKS 

The basic study comprised five tasks. Primary emphasis was given to 
Task 1, Requirements Analysis and Concepts. This task established subsystem 
baseline descriptions and then analyzed them to determine their re liability /main- 
tainability characteristics (criticality, failure modes and effects, maintenance 
concepts and line replaceable unit (LRU) definitions), checkout strategies, test 
definitions, and definitions of stimuli and measurements. After software pre- 
liminary designs were available, an analysis of checkout requirements on the DMS 
was performed. 

A software task was performed to determine the software requirements 
dictated by the results of Task 1. 

Task 3 was a study of onboard electronic maintenance requirements and 
recommendations of concepts to satisfy them. Supporting research and technology 
tasks leading to an onboard maintenance capability were identified. The study 
implementation plan and recommendations for implementing results of the study 
were developed in Task 4. The task final report also summarizes results of the 
study in all technical tasks. 
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Reliability, Task 5, was very limited in scope, resulting in an analysis of 
failure modes and effects in three Space Station subsystems, GN&C, DMS (computer 
group) and RF communications. 

1. 2. 4 PREVIOUS REPORTS 


Results of the basic study were reported by task in the following reports, 
under the general title of "An Engineering Study of Onboard Checkout Techniques, 
Final Report. " 


IBM Number 


Title 


71W-00111 

71W-00112 

71W-00113 

71W-00114 

71W-00115 


Task 1: Requirements Analysis and Concepts 

Task 2: Software 

Task 3: Onboard Maintenance 

Task 4: Summary and Recommendations 

Task 5: Subsystem Level Failure Modes and 
Effects 
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Section 2 


BASELINE SUBSYSTEM DESCRIPTIONS 


2. 1 GENERAL 


This section describes the baseline RF Communications Subsystem which 
was analyzed to define onboard checkout requirements. In order to assess re- 
quirements for onboard checkout, descriptions at the subsystem level and the 
assembly level are required, as well as the major interfaces between subsystems. 

The assembly level description for each of the subsystems (MSFC-DRL-160, 
Line Item 13) provided the primary working document for subsystem analysis. To 
reduce documentation, these documents have been incorporated by reference into 
this report, where applicable. Therefore, where no significant differences exist 
from the Phase B definition, this report contains a brief subsystem description 
and an identification of the referenced document containing the assembly level 
descriptions for that subsystem. Where significant differences do exist, the sub- 
system level description includes these changes in as much detail as is available. 
MSFC-DRL-160, Line Item 19, provided the major subsystem interface descrip- 
tions for analysis of integrated test requirements. 

2.2 SUBSYSTEM LEVEL DESCRIPTION 

The Communications Subsystem comprises all equipment necessary for 
transmitting and receiving, tracking and ranging, command, multiple voice and 
television information, and broadband experiment data. The major RF sub- 
system equipment consists of K -band high gain and VHF/S-band/K -band low 
gain (omnidirectional) antennas, preamplifiers, receivers, transmitters with 
appropriate switching and multiplexing units, signal interface modems, and 
ranging unit. 

The Communications Subsystem provides a radio frequency (RF) interface 
between the Space Station and the ground stations, either directly or indirectly, 
through a Data Relay Satellite System (DRSS), independent free-flying experiment 
modules (FFM), and logistics vehicles (LV). 

The transmission and reception of television, multiple voice, and digital 
information between the Space Station and ground stations through the DRSS will 
be provided by a K -Band System. This link employs three uplink and downlink 
K -band RF carriers operating at frequencies between 13 and 15 GHz. The K - 
Band System consists of (1) four high-gain parabolic reflectors for normal opera- 
tion, (2) transmitters and receivers, and (3) signal interface modems that sum, 
separate, and condition the incoming and outgoing signals. 
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In addition to the DRSS link, direct communications to the ground at S-band 
are required during the early mission phases. Uplink and downlink voice, digital 
data, and ranging capability will be provided by an S-band transponder compatible 
with the MSFN. An S-band FM transmitter is provided on the Space Station to 
permit an Apollo-type television signal, or wide-band real-time or stored data 
to be transmitted to the existing MSFN facilities. The S-band circuits transmit 
and receive through a low gain antenna system. 

The Communications Subsystem provides the capability for simultaneously 
receiving up to 10 channels of video and digital data and transmitting command 
and ranging information from and to the FFMs at K -band. One of the four high 
gain antennas is utilized to support the FFMs while'm the normal stationkeeping 
loop. During docking and undocking operations, the K -band Low Gain Antenna 
System provides the required coverage. u 

Two-way voice, data, and ranging communications between the Space Station 
and the Logistics Vehicles are provided by transmitters and receivers in the VHF 
frequency range. A Low Gain Antenna System at VHF is utilized to provide es- 
sentially spherical coverage. This system also provides voice and low data rate 
communications between the SS and DRSS during artificial gravity and contingency 
operations. Duplex voice and biomedical data reception capability from two crew- 
men engaged in extravehicular activity (EVA) has been provided at VHF. 

The Communications Subsystem equipment has been broken down into eight 
assembly groups and has been grouped primarily according to function as listed 
below: 

1. K -Band High Gain Antenna 

u 

2. VHF/S-Band/K -Band Low Gain Antenna 

u 

3. Free-Flying Module 

4. Data Relay Satellite System 

5. DRSS/FFM Common 

6. Ground (Direct) 

7. Shuttle 

8. Extravehicular Activity 
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The RF communications assembly groups interface directly with the analog 
distribution bus. The operation of the subsystem is controlled by discrete com- 
mands from command decoders. Monitor and checkout information is provided 
to remote data acquisition units (RDAUs). Serial digital data streams are ac- 
cepted from and provided to data terminals and modems which interface with the 
digital distribution bus. The command decoders, RDAUs and data terminals, and 
modems are described under the Data Management Subsystem Description. 

2. 3 ASSEMBLY LEVEL DESCRIPTIONS 


Descriptions of the Communications Subsystem assemblies are provided in 
the Space Station MSFC-DRL-160, Line Item 13, Volume I, Book 2, Space Station 
Electronics. These descriptions include block diagrams, discussions of major 
subassemblies, physical characteristics summary, control inputs, monitor out- 
puts, and a table of interface characteristics. DRL 13, Volume I, Book 2, is 
incorporated by reference into this report as a detailed description of the RF 
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Section 3 

RELIABILITY AND MAINTAINABILITY ANALYSES 

3.1 CRITICALITY ANALYSIS 

As a guide to emphasis in subsequent checkout technique studies, an analysis 
has been made of the overall subsystem and major component criticality (failure 
probability) of the Space Station subsystems and equipment. As an input to the 
Checkout Requirements Analysis Task, this data along with the failure mode and 
effects data will be useful in determining test priorities and test scheduling. 
Additionally, this data will aid in optimizing checkout system design to ensure 
that confidence of failure detection is increased in proportion to added system 
complexity and cost. 

3. 1. 1 CRITICALITY ANALYSIS PROCEDURE 

A criticality number (related to failure probability) was generated for each 
major subsystem component. This number is the product of: (1) the component 
failure rate (or the reciprocal of mean-time-between-failure), (2) the component's 
anticipated usage or duty cycle, and (3) an orbital time period of six months, or 
4, 380 hours. Six months was chosen as the time period of interest to allow one 
missed resupply on the basis of normal resupply occurring at three-month intervals. 
The criticality number, then, is the failure expectation for a particular component 
over any six-month time period. 

For visibility, the major components of each subsystem analyzed have been 
ordered according to the magnitude of their criticality numbers. This number, 
however, should not be considered as an indication of the real risk involved, since 
it does not take into account such factors as redundant components, subsystem 
maintainability, and the alternate operational procedures available. 

Overall subsystem criticality has been determined by a computerized 
optimization process whereby spares and redundancy are considered in terms of 
a trade-off between increased reliability and weight. This determination, there- 
fore, reflects not only the failure probability of subsystem components, but also 
the probability that a spare or redundant component may not be available to 
restore the subsystem to operational status. The methodology used is described 
in Section 9, Long-Life Assurance Study Results, DRL 13 (Preliminary Subsystem 
Design Data), Volume III (Supporting Analyses), Book 4 (Safety/Long Life/Test 
Philosophy) from the MDAC Phase B Space Station Study. Component -level failure 
mode and criticality data are presented in subsequent paragraphs. 
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Table 3-1. Communications Subsystem Criticality Ranking 


Component 


Single Unit 
Criticality 
(10-6) 


S-Band PM Transponder 41, 800 


K u -Band Power 31,400 <100 

Amplifier 

FM Xmtr Modem 18,400 970 


High -Gain Antenna 12,500 1290 

System Assembly 

S-Band Video 11,400 <100 

Receiver Modem 

S-Band Power Amplifier 9,000 <100 

S-Band FM Exciter 7,100 128 

S-Band Data Receiver 5,030 <100 

S-Band Video Receiver 4,600 <10 

3,420 


S-Band PM Receiver 


<10 


- Highest 10 


Remarks 

Reflects that ground transmission via DRSS is 
inoperative 

Reflects ground direct transmission inoperative 

Reflects that direct ground communication is 
inoperative 

Reflects less than optimum antenna positioning 

I 

Considers 3 spares not operating 

Considers ground communication via DRSS outage 

Considers backup with ground communications 
via DRSS 

Considers 3 spares available 
Spares available 


Spares available 



3.1.2 SUBSYSTEM CRITICALITY DATA 


The optimized six-month reliability prediction for.the Communications Sub- 
system is 0. 9972 with 562 pounds of spares. This value assumes optimum per- 
formance of all components with no alternate paths of reception and transmission 
allowed. This value cannot be obtained directly from the criticality numerics 
given in Table 3-1. 

Loss of digital data transmission to ground via relay satellite would require 
either communicating directly with the ground until the failed component was re- 
placed, or storing digital data for transmission at a later time. This concept is 
reflected in the "conditional loss criticality" column of Table 3-1. 

3.2 FAILURE EFFECTS ANALYSIS (FEA) 

The procedure employed in this section is similar to that of the earlier FEA 
analysis, except that a distinction was made between "single" and "multiple" 
failures. The term "multiple failures" implies complete loss of the function 
under consideration. A description of the baseline subsystems is contained in 
Section 2. , 

Generally, this FEA, coupled with other results, indicates that no failure 
modes exist which invalidate the onboard checkout concepts. It is noted that this 
analysis was conducted at the component level, commensurate with available 
Space Station subsystem design definition. 

Examples of the results of the RF Communications Subsystem (RFCS) FEA 
are given in Table 3-2 (a partial listing). 

3.3 MAINTENANCE CONCEPT ANALYSIS 


General maintenance concepts and analyses are summarized in Section 7. 

The RF Communications System is comprised of the High-Gain and Low- 
Gain Antenna Systems, transmitters and receivers, and modems which interface 
the transmitters and receivers with the analog distribution bus. Except for the 
High-Gain Antenna System which has the parabolic reflector, feeds, positioner, 
and low noise preamplifiers located at the end of a boom, and the low-gain antenna 
radiating elements which are located on the surface of the pressure shell, the RF 
communications assemblies are located in either pressurized or pressurizable 
compartments . 
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Table 3-2. RF Communications Subsystem Failure Effect Analysis 


Item 

Function 

Failure Effect On 

Space Station 


Failure Type 

Subsystem 

K u -Band 
Power Amplifier 

Provides power amplification 
required for transmission of 
K u -band signals. 

TWT failure; 
power supply 
failure; 
heater failure. 

a. Single failures: No 
effect due to redun- 
dancy. 

b. Multiple failures: 
Losfv of Ku-band 
transmission 
capability. 

a. None 

b. Loss of TV, 
voice and digital 
communication 
with ground via 
DRSS; loss of 
ranging and com- 
mand data to FFM. 

K u -Band PM 
Exciter 

Phase -modulates K u -band 
carrier with inputs from 
data and ranging modems. 

Open/ short 
electronics. 

a. Single failures; No 
effect due to redun- 
dancy. 

b. Multiple failures; 
Loss of K u -band PM 
data transmission. 

a. None 

b. Loss of digital/ 
ranging interface 
with FFMs; degraded 
digital transmission 
to ground via DRSS. 

K u -Band FM 
Exciter 

Frequency modulates Ku- 
band carrier with television, 
digital, voice, or analog 
data. 

Open/short 

electronics. 

a. Single failures; No 
effect due to redun- 
dancy. 

b. Multiple failures; 
Loss of Ku-band 
FM data. 

a. None 

b. Loss of TV, 
voice, digital, and 
analog communica- 
tion with ground 
via DRSS. 



The high-gain parabolic antennas are designed to be rotated into the end 
docking port for maintenance. This requires the maintenance to be performed in 
a space suit, but in a more compatible work position. The maintenance must be 
planned in less than three -hour task elements because of portable life support suit 
(PLSS) use limits. 

Although undesirable, the Low-Gain Antenna System elements require re- 
placement by EVA. These elements are currently inaccessible from the interior 
of the station. 

The transmitters, receivers, and interface modems are packaged in 
multiples of the 1. 25-inch width of the standard 8- x 9-inch electronic module 
described in DRL 13, Volume I, Book 2, Space Station Electronics. Where possible, 
the assemblies have been sized so as not to exceed more than four standard widths. 

A notable exception is the S-Band power amplifier. Adherence to this packaging 
concept should facilitate maintenance and handling. 

3.4 LINE REPLACEABLE UNIT ANALYSIS 

General guidelines and criteria for the definition of LRUs were established 
and these along with the maintenance philosophies reported in Section 3-3 were 
used to determine at what level line maintenance would be performed. For the 
Space Station subsystems specific justification applicable to LRU selection for the 
particular subsystem under examination was derived from the guidelines and 
these justifications are presented along with the LRU listing. The "functional 
LRUs" were then considered in the light of the standard electronic packaging 
scheme and actual LRUs were defined and listed. The method employed and 
the results achieved are discussed in the following sections. 

3.4. 1 SPACE STATION RF SUBSYSTEM LINE REPLACEABLE UNITS 

The definition of Line Replaceable Units (LRUs) is keyed to repairing sub- 
systems in an in-place configuration with the LRU being the smallest modular 
unit suitable for replacement. General factors considered in identifying sub- 
system LRUs include: (1) maintenance concepts developed and defined in Section 
3.3; (2) the component-level failure rates delineated in the criticality analyses 
of Section 3. 1; (3) the amount of crew time and skill required for fault isolation 
and repair; (4) resultant DMS hardware and software complexity; and (5) subsystem 
weight, volume, location, and interchangeability characteristics. Listings of 
LRUs and more specific justification for their selection follows. 

The transmitters (exciters and power amplifiers), receivers, and interface 
modems are selected as assembly-level LRUs largely because of packaging, 
reliability, and electromagnetic interference (EMI) considerations. These 
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assemblies are packaged in multiples of the standard module size for mounting 
in the integrally-cooled mounting racks. Initial reliability estimates indicate 
that the power amplifiers are the most critical of this group of assemblies. 


is not practical 


Lower level modularization of the power amplifiers, however, 
because of restrictions caused by the physical dimensions of the Traveling Wave 
Tube (TWT), thermal cooling requirements, and sensitivity to changes in power 
supply voltages. It is planned, therefore, that the TWT and power supplies be 
mated and adjusted as a unit on the ground. Furthermore, lower level modularity 
would increase the number of connectors required, thereby decreasing overall 
reliability and creating potential sources of EMI. Another problem encountered 
with a lower replacement level is module-to-module tolerance buildup. This 
concept was attempted, for example, on an S-Band transponder 1 for another 
program and resulted in modules not being interchangeable that were supposed 
to be interchangeable. 


The primary considerations used in the selection of LRUs for the High- and 
Low-Gain Antenna Systems are somewhat different from those used for trans- 
mitters, receivers, and modems. Antenna system LRUs typically do not require 
thermal cooling and are consequently located largely on the basis of minimizing 
RF transmission line losses. The reliability of multiplexers, power dividers, 
coaxial cables, and the low-gain antenna elements is relatively high. The major- 
ity of the problems associated with Low-Gain Antenna (omnidirectional) Systems, 
if encountered, usually occur during initial installation and checkout. This is also 
true for similar components of the High- Gain Antenna System located within the 
pressure shell. 


The most difficult maintenance and replacement problems are posed by the 
portion of the High-Gain Antenna System located at the end of the mast. If a 
failure occurs in the drive system, the drive system is replaced in its entirety 
to eliminate alignment problems. The drive motors, on the other hand, can be 
replaced separately in the event of failure. Redundant electronics are utilized 
wherever possible to minimize the high- gain antenna downtime. 

A listing of LRUs for the RF Communications Subsystem is provided in 
Table 3-3. 
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Table 3-3. RF Communications 


LRU 

Quantity 

„ . , Standby 

Required _ , , , 

Redundant 

Transmitter/Receiver/Modem/Group 

S-Band Video Receiver 

10 

Video Receiver Modem 

10 

S-Band Data Receiver 

10 

S-Band PM Receiver 

2 

K u -Band FM Exciter 

2 

FM Xmtr Modem 

2 

S-Band FM Receiver 

2 

Receiver Modem 

2 

K u -Band PA 

5 

K u -Band PM Exciter 

5 

S-Band PM Transponder 

2 

Transponder Modem 

2 

S-Band Power Amp 

2 

S-Band FM Exciter 

2 

Transmitter Modem 

2 

VHF Voice Ranging T/R 

2 

Ranging Modem 

2 

Voice Modem 

2 

VHF Data T/R 

2 

VHF-FM T/R 

6 

Modem 

2 

Low-Gain Antenna Group 

VHF Antennas 

4 

VHF Diplexers 

4 

VHF Multiplexer, Power Dividers and Switches 

2 

S-Band Antennas 

4 

S-Band Triplexer and Switches 

2 

K u -Band Antennas 

8 

K u -Band Preamp/Mixer/Diplexer /Switches 

2 

S-Band Multiplexer and Circulator 

2 

K u -Band Waveguides 

8 

VHF/S-Band Coaxial Cables 

8 
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Table 3-3. RF Communications (Continued) 



Quantity 

LRU 

Required 

Standby 

Redundant 

High-Gain Antenna Group 



Main Reflector/Feed 

4 


Acquisition Reflector/Feed 

4 


Pseudo Monopulse Comp/Mod. 

8 

8 

Positioner 



Drive Motors 

8 


Drive System 

8 


Electronics 

8 

8 

K u -Band TDA/Mixer/L.O. 

8 

8 

RF Switches (External) 

2 


RF Switches (Internal) 

8 


K u -Band Quadriplexers and Circulators 

4 


Ku-Band Diplexer 

1 


S-Band Quadriplexer and Power Divider 

4 


S-Band Diplexer 

1 


K u -Band Waveguides 

4 
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Section 4 


/ 

OCS CHECKOUT STRATEGIES 


4.1 SUBSYSTEM CHECKOUT STRATEGY 

Prior to any further requirements analysis, it is necessary to develop a 
checkout strategy for all Space Station subsystems to meet the checkout objectives 
of the Space Station OCS. The objectives of the Space Station OCS can be 
summarized as follows: 

• To increase crew and equipment safety by providing an immediate 
indication of out-of-tolerance conditions 

• To improve system availability and long-life subsystems assurancy 
by expediting maintenance tasks and increasing the probability 
that systems will function when needed 

o To provide flexibility to accommodate changes and growth in both 
hardware and software 

e To minimize development and operational risks 

Specific mission or vehicle-related objectives which can be imposed upon 
subsystem level equipment and subsystem responsibilities include the following: 

• OCS should be largely autonomous of ground control. 

• Crew participation in routine checkout functions should be minimized. 

• The design should be modular in both hardware and software to 
accommodate growth and changes . 

• OCS should be integrated with, or have design commonality with, 
other onboard hardware or software . 

• The OCS should use a standard hardware interface with equipment 
under test to facilitate the transfer of data and to make the system 
responsive to changes. 

• Failures should be isolated to an LRU such that the faulty unit can be 
quickly removed and replaced with an operational unit. 
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• A Caution and Warning System should be provided to facilitate crew 
warning and automatic "safing" where required. 

• Provisions must be included to select and transmit any part or all of 
the OCS test data points to the ground. 

To attain these objectives via the use of an Onboard Checkout System which 
is integrated with the Data Management System, checkout strategies have been 
developed which are tailored to each Space Station subsystem. 

Special emphasis has been applied to a strategy for checkout of redundant 
elements peculiar to each subsystem. The degree to which each of these functions 
is integrated into the DMS is also addressed. 

4.1.1 SPACE STATION SUBSYSTEMS 

Each major Space Station subsystem was examined with respect to the re- 
quired checkout functions. The checkout functions associated with each subsystem 
are identified and analyzed as to their impact on the onboard checkout task. The 
functions considered are those necessary to verify operational status, detect and 
isolate faults, and to verify proper operation following fault correction. Specific 
functional requirements considered include stimulus generation, sensing, signal 
conditioning, limit checking, trend analysis, and fault isolation. 

4. 1. 1. 1 RF Communications Subsystem 

The RF Communications Subsystem (RFCS) contains the receivers, trans- 
mitters, power amplifiers, transponders, modems, and antenna systems to pro- 
vide radio frequency communications between the Space Station and the ground, 
DRSS, Shuttle, free-flying experiment modules, and EVA crewmen. The sub- 
system operates in the S, K u , and VHF bands. 

4. 1. 1. 1. 1 Checkout Functions 

Fault detection in the RF Communications Subsystem utilizes both operation- 
al monitoring and specific functional test routines. The operational monitoring 
takes place continuously while the system is in use and involves both the onboard 
and ground crews to a great extent. Assessment of system performance is made 
in much the same way one "checks out" his home communications equipment such 
as telephone and television, i. e. , by listening to or looking at the output. Such 
tests are somewhat gross and subjective of course, and must be augmented by 
functional tests which include more precise qualitative analysis of performance. 
These functional tests may be performed on a scheduled periodic basis or as an 
aid to fault isolation in the event of a malfunction. Checkout of portions of the 
system will also be required prior to initiation of certain operations, such as a 
rendezvous and docking. Functional tests generally involve the injection of cali- 
brated test stimuli and evaluation of equipment response. 
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• Stimulus Generation - Checkout of the various S-band, Ku-band, and 
VHF receivers requires the capability to inject RF test stimuli of the 
appropriate frequency and modulation characteristics into the receiver 
front ends and measure the corresponding receiver outputs and Auto- 
matic Gain Control (AGC) levels. Testing of transmitters and of the 
receiver and transmitter modems requires the injection of modulating 
test signals, of the appropriate type and format. Stimulus requirements 
are included in Appendix I. 

• Sensing - Sensing requirements associated with the RFCS are tabulated 
in Appendix I. 

The 0-5 Vdc range given for the AGC, RF power, and Voltage Standing 
Wave Ratio (VSWR) levels are conditioned sensor output levels rather 
than "raw" signal ranges and reflect the selected RFCS design approach 
of providing integral signal conditioning at the LRU level. Similarly, 
the bilevel status indicator parameters represent a variety of "raw" 
parameters including mode selections, switch positions, presence of 
primary power, and presence of input and/or output modulation. The 
selector switch position parameters indicate the position of multiposi- 
tion switch elements such as channel selectors and antenna switches. 
These parameters are internally encoded such that a twelve -position 
switch, for example, is represented in the form of a four-bit binary 
word. 

• Signal Conditioning - The measurement signal conditioning for the RFCS 
is included as an integral portion of the subsystem at the "black box" or 
LRU level. The measurements are therefore directly compatible with 
the data management subsystem. 

• Limit Checking - Limit checks of the continuous or random type have 
limited applicability in the RFCS. This is due to the fact that the ma- 
jority of the significant subsystem performance parameters, such as 
RF output power, are meaningful only when the equipment is actually 
transmitting or, as in the case of receiver sensitivity (AGC) measure- 
ments, when a calibrated input signal is present. Limit testing oppor- 
tunities are therefore largely confined to periodic test situations where 
the necessary conditions can be established. 

• Trend Analysis - Application of trend analysis techniques to selected 
RFCS measurements is potentially useful in detecting degradation and 
impending failures in such equipment as transmitters and receivers. 

In particular, the RF power output and VSWR of the transmitters 
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and the AGC level of the receivers are good performance indicators and 
are amenable to such analysis. Care must be exercised, however, to 
assure proper correlation between these measurements and the various 
factors which influence them. Meaningful receiver sensitivity data, for 
example, is highly dependent upon accurate calibration of the input test 
signal. The maintenance of sufficiently accurate calibration of test 
stimuli and measurement equipment over a long term orbital mission 
is a problem not previously encountered in the space program and will 
require careful consideration. 

4 1.1.1.2 Redundant Element Checkout 

Redundancy in the RFCS is in the form of functional redundancy, as typified 
by the capability to communicate with the ground either directly or via DRSS, and 
in duality of systems as in the case of the dual antenna systems. These dual or 
functionally overlapping areas of equipment are independent' of each other, however, 
and therefore do not constitute redundancy in the normal switchable or parallel 
equipment sense. As such, no unique checkout problems exist. 

4- 1- 1. 1. 3 Integration with Data Management Subsystem 

Stimulus requirements for the RFCS include modulated S-band, K u -band, 
and VHF RF signals, analog signals, and digital inputs. The RF signals in par- 
ticular are relatively complex and are unique to the subsystem. These are there- 
fore generated by equipment internal to the subsystem. The control of these 
signals is a function of the DMS. The various analog signals (i.e. audio, video, 
etc. ) required for modulation testing are likewise generated internally under DMS 
control. Digital test inputs required for checkout of the PM modems and exciters 
are supplied directly by the DMS via the data bus. 

Measurement sensors and signal conditioning for the Communications Sub- 
system are provided as an integral part of that subsystem. The signal interface 
between the RFCS and the DMS is in the form of standard 0-5 Vdc signals for each 
measurement. 
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4.2 INTEGRATED CHECKOUT STRATEGY 

This analysis identifies the integrated checkout functions associated with 
Space Station subsystems during the manned orbital phase of the mission. These 
functions are depicted in Figure 4-1 and are those required to ensure overall 
availability of the Space Station. Characteristic of integrated testing is the fact 
that the test involves subsystem interfaces, and, therefore, test objectives are 
associated with more than one subsystem. 

4.2.1 INTEGRATED STRATEGY 

Six checkout functions have been identified: 

o Caution and warning 
0 Fault detection • 

a Trend analysis 
0 Operational status 

0 Periodic checkout 

0 Fault isolation 

These functions represent a checkout strategy of continuous monitoring and 
periodic testing with eventual fault isolation to a line replaceable unit (LRU). 
Under this aspect the functions are grouped as - 

CONTINUOUS MONITORING PERIODIC TESTING FAULT ISOLATION 

o Caution and warning 
0 Fault detection 
0 Trend analysis 
0 Operational status 


• Automatic tests • Localize to SS 

• Operational • Isolate to RLU 

Verification 
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General characteristics of these groups are defined below: . 

4.2. 1.1 Continuous Monitoring ’ 

r 

Continuous monitoring is not a test per se. It is a concept of continuously 
sampling and evaluating key subsystem parameters for in/out-of -tolerance con- 
ditions. This evaluation does not necessarily confirm that the subsystems have 
failed or are operating properly. The evaluation is only indicative of the general 
status of the subsystems. For example, a condition exists where the integrated sub- 
systems are indicating in-limit conditions, but during the next series of attitude con- 
trol commands, an error in Space Station position is sensed and displayed. Since 
three subsystems, DMS, GN&C, and P/RCS, are involved in generating and 
controlling the Space Station attitude, a "positional error" malfunction is not 
directly related to a subsystem malfunction. The malfunction indication is only 
indicative of an out-of-tolerance condition of an integrated function. Final resolu- 
tion of the problem to a subsystem and eventually to LRU will require diagnostic 
test-procedures that are separate from the continuous monitoring function. 

There are situations in which the parameters being monitored are intended 
to be directly indicative of the condition of a subsystem or an LRU. Examples of 
these include tank pressures, bearing temperatures, and power source voltages. 
However, even in these simpler cases when a malfunction is detected, an integrated 
evaluation will be performed to ascertain that external control functions, transducers, 
signal conditioning, and the DMS functions of data acquisition, transmission, and 
computation are performing properly. This evaluation will result in either a sub- 
stantiation of the malfunction or identification of a problem external to the param- 
eter being monitored. 

Figure 4-1 shows the logic associated with each function in the continuous 
monitoring group, as well as the integrated relationships between these and the 
total checkout functions. The caution/warning and fault detection functions are 
alike in their automatic test and malfunction detection approaches, but are differ- 
ent in terms of parameter criticality and malfunction reaction. The caution/warn- 
ing function monitors parameters that are indicative of conditions critical to crew 
or equipment safety. Parameters not meeting this criticality criteria are handled 
as fault detection functions. Figure 4-1 shows that in the event of a critical mal- 
function, automatic action is initiated to warn the crew and sequence the sub- 
systems to a safe condition. Before this automatic action is taken, the subsystems 
must be evaluated to ascertain that the failure indication is not a false alarm and 
that the corrective action can be implemented. After the action is taken, the sub- 
systems must be evaluated to determine that proper crew safety conditions exist. 

Since automatic failure detection and switching can be integral to subsystem de- 
sign (self-contained correction) and subsystems can be controlled by the operation- 
al software or manual controls, it is imperative that the status of these events be 
maintained and that the fault detection and correction software be interfaced with 
the prime controlling software. For malfunctions that are not critical, the crew 
is notified of their occurrence, but any subsequent action is initiated manually. 
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Figure 4-1. Integrated Checkout Functional Flow 


























The next continuous monitoring function, trend analysis, automatically ac- 
quires data and analyzes the historical pattern to determine signal drift and the 
need for unscheduled calibration. It also predicts faults and indicates the need 
for diagnostic and fault isolation activities. An example of a parameter in this 
category is the partial pressure of nitrogen. Nitrogen is used to establish the 
proper total pressure of the Space Station. Since it is an inert gas, the only make- 
up requirements are those demanded by leakage or airlock operation. The actual 
nitrogen flow rate is measured, and calculations are performed which make 
allowances for normal leakage and operational use. When these calculations 
indicate a trend toward more than anticipated use, the crew is automatically 
notified and testing is initiated to isolate the problem to the gas storage and 
control equipment or to an excessive leak path. The historical data is not only 
useful in predicting conditions but is also useful in providing trouble-shooting clues. 
The data might reveal, for example, that the makeup rate increased significantly 
after the use of an airlock. This could lead directly to verifying excessive seal 
leakage. 

The final continuous monitor function is in operational status. This function 
is performed by the crew and is nonautomatic with the exception of the DMS com- 
puter programs associated with normal Space Station operational control and 
display functions. The concept of continuous monitoring recognized and takes 
advantage of the crew's presence and judgment in evaluating Space Station per- 
formance. In many instances the crew can discern between acceptable and un- 
acceptable performance, and they can clearly recognize physically-damaged 
equipment or abnormal conditions. 

4. 2.1.2 Periodic Testing 

As opposed to continuous monitoring, periodic testing is a detailed evalua- 
tion of how well the Space Station subsystems are performing. Figure 4-1 shows 
that periodic testing is not accomplished by any one technique. Rather, a com- 
bination of operational and automatic test approaches is employed. The actual 
operational use of equipment is often the best check of the performance of that 
equipment. Operation of Space Station equipment and use of the normal operating 
controls and displays will be used in detecting faults and degradation in the sub- 
systems. This mode of testing is primarily limited to that equipment whose 
performance characteristics are easily discernible, such as for motors, lighting 
circuits, and alarm functions. 

Automatic testing is performed in two basic modes: 

• With the subsystems in an operating mode, the DMS executes a diagnos- 
tic test procedure which verifies that integrated Space Station functions 
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. II 

are being properly performed under normal interface conditions in 

response to natural or designed stimulation. 'This mode of testing 

allows the evaluation of Space Station performance without interrupting 
mission operations. 

• For those situations where the integrated performance or interface 
compatibility between subsystems cannot be determined without known 
references or control conditions, the DMS will execute a diagnostic 
procedure in a test mode. In this mode, control, reference, or bias 
signals will be switched in or superimposed on the subsystems to allow 
an exact determination of their performance or localization of problem 
between the interfaces. Since the test mode may temporarily inhibit 
normal operations, the DMS must interleave the test and operational 
software to maintain the Space Station in a known and safe configuration. 

The scheduled automatic tests are performed to verify availability or proper 
configuration of "on-line" subsystems, redundant equipment, and alternate modes. 

• Perio dic Verification of "On-Line" Subsystems - The first checkout 
requirement is a periodic verification that on-line subsystems are 
operating within acceptable performance margins. The acceptable 
criteria for this evaluation is based on subsystem parameter limits and 
characteristics exhibited during Space Station factory acceptance or 
pre-flight testing. The rejection criteria and subsequent decision to 
repair or reconfigure subsystems is based on the criticality of the 
failure mode. If the subsystems appear to be operating properly, but 
the test clearly indicates an out-of-tolerance condition, then one of the 
following alternatives must be implemented: 

If the failure mode is critical, the crew normally takes immediate 
action to isolate and clear the problem. 

If the failure mode is not critical, the crew can take immediate 
action, schedule the work at a later time, or wait until the condi- 
tion degrades to an unacceptable level. 

* Redunda nt Equipment Verification - A second checkout requirement is 
verifying that standby, off-line, or redundant equipment and associated 
control and switching mechanisms are operable. The acceptable/re- 
jection criteria for these evaluations is identical to those for normally 
operating equipment. A primary distinction of this function is that 
equipment may have known failures from previous usage or tests. This 
situation occurs when the crew has knowledge of a failure but has not 
elected to perform the necessary corrective action; The checkout 
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function then becomes one of equipment status accounting and main- 
tenance/repair scheduling. The status information is interlocked with 
mission procedures and software to preclude activation of failed units 
while they are being repaired or until proper operation following repair 
is verified. 

• Alternate Mode Verification - The third checkout function is verifying the 
availability of alternate modes of operation. This function is essentially 
a confidence check of the compatibility of subsystems'interaction and 
performance during and after a change in the operating mode. To some 
extent this function overlaps with redundant equipment verification, but 
is broader in scope in that it verifies other system-operating character- 
istics. For example, some modes will involve manual override or 
control of automatic functions or automatic power-down sequences. 

4. 2. 1.3 Fault Isolation 

Fault isolation to an LRU is a Space Station goal. As shown in Figure 4-1, 
fault isolation testing is initiated when malfunction indications cannot be directly 
related to a failed LRU. The integrated test functions associated with fault isola- 
tion are localizing a malfunction to a subsystem or to an explicit interface between 
two subsystems and identifying the subroutine test necessary for LRU isolation. 

In structuring this relationship between integrated subsystem tests for fault local- 
ization and subroutine tests for fault isolation, the DMS, in conjunction with the 
test procedure documentation, must establish an effective man-machine interface 
so that in the event of an unsolved malfunction the crew will be able to help evalu- 
ate the condition and determine other test sequences necessary to isolate the 
problem. To accomplish this requirement, the DMS must be capable, of displaying 
test parameters and instructions in engineering units and language and be capable 
of referencing these outputs to applicable documentation or programs that correl- 
ate test results to corrective action required by the crew. 
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Section 5 

ONBOARD CHECKOUT TEST DEFINITIONS 


5. 1 SUBSYSTEM TEST DEFINITIONS 

The on-orbit tests required to insure the availability of the Space Station 
subsystems are defined herein. Also delineated are the measurement and 
stimulus parameters required to perform these tests. Two discrete levels of 
testing are defined, i. e. , continuous status monitoring tests for fault detection of 
critical and noncritical parameters, and subsystem fault isolation tests for 
localization of faults to a specific Line Replaceable Unit. In addition to these two 
levels, tests are defined for periodic checkout and calibration of certain units, 
and parameters requiring analysis of trends are defined. 

Due to the software module approach to DMS checkout, it was deemed 
necessary to estimate the CPU time and memory required to implement these 
modules along with an assessment of the services required from an Executive 
Software System to control the checkout. 

These test descriptions, measurement, and stimulus information provided 
for each subsystem, and the software sizing information provided for the Data 
Management System provide the data required to estimate the checkout impact 
on the DMS software and hardware. Table 5-1 is a summary of the measurement 
and stimulus requirements for the Space Station. 

The RF Communications Subsystem contains the receiver, transmitters, 
power amplifiers, transponders, modems, and antenna systems to provide radio 
frequency communications between the Space Station and the ground, DRSS, Shuttle, _ 
free-flying experiment modules, and EVA crewmen. The subsystem operates in 
the S, K u , and VHF bands. 

On-orbit checkout activities required to insure the availability of the sub- 
system include monitoring of its normal operational outputs, performing periodic 
checks, and selecting fault isolation routines associated with the loss of a com- 
munications function. In addition, some trending and calibration are required. 
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The RF communications assembly groups interface directly with the analog 
distribution bus. The operation of the subsystem is controlled by discrete com- 
mands from command decoders. Monitor and checkout information is provided 
to remote data acquisition units (RDAUs). Serial digital data streams are ac- 
cepted from and provided to data terminals and modems which interface with the 
digital distribution bus. The command decoders, RDAUs and data terminals, and 
modems are described under the Data Management Subsystem Description. 

2. 3 ASSEMBLY LEVEL DESCRIPTIONS 


Descriptions of the Communications Subsystem assemblies are provided in 
the Space Station MSFC-DRL-160, Line Item 13, Volume I, Book 2, Space Station 
Electronics. These descriptions include block diagrams, discussions of major 
subassemblies, physical characteristics summary, control inputs, monitor out- 
puts, and a table of interface characteristics. DRL 13, Volume I, Book 2, is 
incorporated by reference into this report as a detailed description of the RF 
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Section 3 


RELIABILITY AND MAINTAINABILITY ANALYSES 
3 . 1 CRITICALITY ANALYSIS 


As a guide to emphasis in subsequent checkout technique studies, an analysis 
has been made of the overall subsystem and major component criticality (failure 
probability) of the Space Station subsystems and equipment. As an input to the 
Checkout Requirements Analysis Task, this data along with the failure mode and 
effects data will be useful in determining test priorities and test scheduling. 
Additionally, this data will aid in optimizing checkout system design to ensure 
that confidence of failure detection is increased in proportion to added system 
complexity and cost. 

3.1.1 CRITICALITY ANALYSIS PROCEDURE 

A criticality number (related to failure probability) was generated for each 
major subsystem component. This number is the product of: (1) the component 
failure rate (or the reciprocal of mean-time-between-failure), (2) the component's 
anticipated usage or duty cycle, and (3) an orbital time period of six months, or 
4, 380 hours. Six months was chosen as the time period of interest to allow one 
missed resupply on the basis of normal resupply occurring at three-month intervals. 
The criticality number, then, is the failure expectation for a particular component 
over any six-month time period. 

For visibility, the major components of each subsystem analyzed have been 
ordered according to the magnitude of their criticality numbers. This number, 
however, should not be considered as an indication of the real risk involved, since 
it does not take into account such factors as redundant components, subsystem 
maintainability, and the alternate operational procedures available. 

Overall subsystem criticality has been determined by a computerized 
optimization process whereby spares and redundancy are considered in terms of 
a trade-off between increased reliability and weight. This determination, there- 
fore, reflects not only the failure probability of subsystem components, but also 
the probability that a spare or redundant component may not be available to 
restore the subsystem to operational status. The methodology used is described 
in Section 9, Long-Life Assurance Study Results, DRL 13 (Preliminary Subsystem 
Design Data), Volume III (Supporting Analyses), Book 4 (Safety/Long Life/Test 
Philosophy) from the MDAC Phase B Space Station Study. Component-level failure 
mode and criticality data are presented in subsequent paragraphs. 
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Table 3-1. Communications Subsystem Criticality Ranking - Highest 10 


Component 

Single Unit 
Criticality 
(10-6) 

Conditioned 
Loss Criticality 
(10-6) 

Remarks 

S-Band PM Transponder 

41,800 

450 

Reflects that ground transmission via DRSS is 
inoperative 

K u -Band Power 
Amplifier 

31,400 

<100 

Reflects ground direct transmission inoperative 

FM Xmtr Modem 

18,400 

970 

Reflects that direct ground communication is 
inoperative 

High -Gain Antenna 
System Assembly 

12,500 

1290 

Reflects less than optimum antenna positioning 

S-Band Video 
Receiver Modem 

11,400 

<100 

Considers 3 spares not operating 

S-Band Power Amplifier 

9,000 

<100 

Considers ground communication via DRSS outage 

S-Band FM Exciter 

7,100 

128 

Considers backup with ground communications 
via DRSS 

S-Band Data Receiver 

5,030 

<100 

Considers 3 spares available 

S-Band Video Receiver 

4,600 

<10 

Spares available 

S-Band PM Receiver 

3,420 

<10 

Spares available 



3. 1. 2 SUBSYSTEM CRITICALITY DATA 


The optimized six-month reliability prediction forthe Communications Sub- 
system is 0. 9972 with 562 pounds of spares. This value assumes optimum per- 
formance of all components with no alternate paths of reception and transmission 
allowed. This value cannot be obtained directly from the criticality numerics 
given in Table 3-1. 

Loss of digital data transmission to ground via relay satellite would require 
either communicating directly with the ground until the failed component was re- 
placed, or storing digital data for transmission at a later time. This concept is 
reflected in the "conditional loss criticality" column of Table 3-1. 

3.2 FAILURE EFFECTS ANALYSIS (FEA) 

The procedure employed in this section is similar to that of the earlier FEA 
analysis, except that a distinction was made between "single" and "multiple" 
failures. The term "multiple failures" implies complete loss of the function 
under consideration. A description of the baseline subsystems is contained in 
Section 2. 

Generally, this FEA, coupled with other results, indicates that no failure 
modes exist which invalidate the onboard checkout concepts. It is noted that this 
analysis was conducted at the component level, commensurate with available 
Space Station subsystem design definition. 

Examples of the results of the RF Communications Subsystem (RFCS) FEA 
are given in Table 3-2 (a partial listing). 

3.3 MAINTENANCE CONCEPT ANALYSIS 


General maintenance concepts and analyses are summarized in Section 7. 

The RF Communications System is comprised of the High-Gain and Low- 
Gain Antenna Systems, transmitters and receivers, and modems which interface 
the transmitters and receivers with the analog distribution bus. Except for the 
High-Gain Antenna System which has the parabolic reflector, feeds, positioner, 
and low noise preamplifiers located at the end of a boom, and the low-gain antenna 
radiating elements which are located on the surface of the pressure shell, the RF 
communications assemblies are located in either pressurized or pressurizable 
compartments . 
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Table 3-2. RF Communications Subsystem Failure Effect Analysis 


Item 

Function 

Failure Effect On 

Space Station 


Failure Type 

Subsystem 

K u -Band 

Provides power amplification 

TWT failure; 

a. Single failures: No 

a. None 

Power Amplifier 

required for transmission of 
K u -band signals. 

power supply 
failure; 
heater failure. 

effect due to redun- 
dancy. 

b. Multiple failures: 
Loss of Ku-band 
transmission 
capability. 

b. Loss of TV, 
voice and digital 
communication 
with ground via 
DRSS; loss of 
ranging and com- 
mand data to FFM. 

K u -Band PM 

Phase-modulates K u -band 

Open/short 

a. Single failures; No 

a. None 

Exciter 

carrier with inputs from 
data and ranging modems. 

electronics. 

effect due to redun- 
dancy. 

b. Multiple failures; 
Loss of K u -band PM 
data transmission. 

b. Loss of digital/ 
ranging interface 
with FFMs; degraded 
digital transmission 
to ground via DRSS. 

K u -Band FM 

Frequency modulates K u - 

Open/short 

a. Single failures; No 

a. None 

Exciter 

band carrier with television, 
digital, voice, or analog 
data. 

electronics. 

effect due to redun- 
dancy. 

b. Multiple failures; 
Loss of K u -band 
FM data. 

b. Loss of TV, 
voice, digital, and 
analog communica- 
tion with ground 
via DRSS. 



The high-gain parabolic antennas are designed to be rotated into the end 
docking port for maintenance. This requires the maintenance to be performed in 
a space suit, but in a more compatible work position. The maintenance must be 
planned in less than three-hour task elements because of portable life support suit 
(PLSS) use limits. 

Although undesirable, the Low- Gain Antenna System elements require re- 
placement by EVA. These elements are currently inaccessible from the interior 
of the station. 

The transmitters, receivers, and interface modems are packaged in 
multiples of the 1. 25-inch width of the standard 8- x 9-inch electronic module 
described in DRL 13, Volume I, Book 2, Space Station Electronics. Where possible, 
the assemblies have been sized so as not to exceed more than four standard widths. 

A notable exception is the S-Band power amplifier. Adherence to this packaging 
concept should facilitate maintenance and handling. 

3.4 LINE REPLACEABLE UNIT ANALYSIS 


General guidelines and criteria for the definition of LRUs were established 
and these along with the maintenance philosophies reported in Section 3-3 were 
used to determine at what level line maintenance would be performed. For the 
Space Station subsystems specific justification applicable to LRU selection for the 
particular subsystem under examination was derived from the guidelines and 
these justifications are presented along with the LRU listing. The "functional 
LRUs" were then considered in the light of the standard electronic packaging 
scheme and actual LRUs were defined and listed. The method employed and 
the results achieved are discussed in the following sections. 

3.4. 1 SPACE STATION RF SUBSYSTEM LINE REPLACEABLE UNITS 

The definition of Line Replaceable Units (LRUs) is keyed to repairing sub- 
systems in an in-place configuration with the LRU being the smallest modular 
unit suitable for replacement. General factors considered in identifying sub- 
system LRUs include: (1) maintenance concepts developed and defined in Section 
3.3; (2) the component-level failure rates delineated in the criticality analyses 
of Section 3.1; (3) the amount of crew time and skill required for fault isolation 
and repair; (4) resultant DMS hardware and software complexity; and (5) subsystem 
weight, volume, location, and interchangeability characteristics. Listings of 
LRUs and more specific justification for their selection follows. 

The transmitters (exciters and power amplifiers), receivers, and interface 
modems are selected as assembly-level LRUs largely because of packaging, 
reliability, and electromagnetic interference (EMI) considerations. These 
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assemblies are packaged in multiples of the standard module size for mounting 
in the integrally- cooled mounting racks. Initial reliability estimates indicate 
that the power amplifiers are the most critical of this group of assemblies. 

Lower level modularization of the power amplifiers, however, is not practical 
because of restrictions caused by the physical dimensions of the Traveling Wave 
Tube (TWT), thermal cooling requirements, and sensitivity to changes in power 
supply voltages. It is planned, therefore, that the TWT and power supplies be 
mated and adjusted as a unit on the ground. Furthermore, lower level modularity 
would increase the number of connectors required, thereby decreasing overall 
reliability and creating potential sources of EMI. Another problem encountered 
with a lower replacement level is module -to -module tolerance buildup. This 
concept was attempted, for example, on an S-Band transponder for another 
program and resulted in modules not being interchangeable that were supposed 
to be interchangeable. 

The primary considerations used in the selection of LRUs for the High- and 
Low -Gain Antenna Systems are somewhat different from those used for trans- 
mitters, receivers, and modems. Antenna system LRUs typically do not require 
thermal cooling and are consequently located largely on the basis of minimizing 
RF transmission line losses. The reliability of multiplexers, power dividers, 
coaxial cables, and the low-gain antenna elements is relatively high. The major- 
ity of the problems associated with Low-Gain Antenna (omnidirectional) Systems, 
if encountered, usually occur during initial installation and checkout. This is also 

true for similar components of the High-Gain Antenna System located within the 
pressure shell. 

The most difficult maintenance and replacement problems are posed by the 
portion of the High-Gain Antenna System located at the end of the mast. If a 
failure occurs in the drive system, the drive system is replaced in its entirety 
to eliminate alignment problems. The drive motors, on the other hand, can be 
replaced separately in the event of failure. Redundant electronics are utilized 
wherever possible to minimize the high-gain antenna downtime. 

A listing of LRUs for the RF Communications Subsystem is provided in 
Table 3-3. 
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Table 3-3. RF Communications 


LRU 

Quantity 

„ . , Standby 

equire Redundant 

Transmitter/Receiver/Modem/Group 


S-Band Video Receiver 

10 

Video Receiver Modem 

10 

S-Band Data Receiver 

10 

S-Band PM Receiver 

2 

K u -Band FM Exciter 

2 

FM Xmtr Modem 

2 

S-Band FM Receiver 

2 

Receiver Modem 

2 

Ku-Band PA 

5 

K u -Band PM Exciter 

5 

S-Band PM Transponder 

2 

Transponder Modem 

2 

S-Band Power Amp 

2 

S-Band FM Exciter 

2 

Transmitter Modem 

2 

VHF Voice Ranging T/R 

2 

Ranging Modem 

2 

Voice Modem 

2 

VHF Data T/R 

2 

VHF-FM T/R 

6 

Modem 

2 

Low-Gain Antenna Group 


VHF Antennas 

4 

VHF Diplexers 

4 

VHF Multiplexer, Power Dividers and Switches 

2 

S-Band Antennas 

4 

S-Band Triplexer and Switches 

2 

Ku-Band Antennas 

8 

K u -Band Preamp/Mixer/Diplexer/Switches 

2 

S-Band Multiplexer and Circulator 

2 

K u -Band Waveguides 

8 

VHF/S-Band Coaxial Cables 

8 
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Table 3-3. RF Communications (Continued) 


LRU 

Quantity 

_ . , Standby 

Required _ , , \ 

Redundant 

High-Gain Antenna Group 
Main Reflector/Feed 

4 


Acquisition Reflector/Feed 

4 


Pseudo Monopulse Comp /Mod. 

8 

8 

Positioner 
Drive Motors 

8 


Drive System 

8 


Electronics 

8 

8 

K u -Band TDA/Mixer/L.O. 

8 

8 

RF Switches (External) 

2 


RF Switches (Internal) 

8 


K u -Band Quadriplexers and Circulators 

4 


K u -Band Diplexer 

1 


S-Band Quadriplexer and Power Divider 

4 


S-Band Diplexer 

1 


K u -Band Waveguides 

4 
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Section 4 


OCS CHECKOUT STRATEGIES 


4.1 SUBSYSTEM CHECKOUT STRATEGY 

Prior to any further requirements analysis, it is necessary to develop a 
checkout strategy for all Space Station subsystems to meet the checkout objectives 
of the Space Station OCS. The objectives of the Space Station OCS can be 
summarized as follows: 

• To increase crew and equipment safety by providing an immediate 
indication of out-of-tolerance conditions 

• To improve system availability and long-life subsystems assurancy 
by expediting maintenance tasks and increasing the probability 
that systems will function when needed 

• To provide flexibility to accommodate changes and growth in both 
hardware and software 

• To minimize development and operational risks 

Specific mission or vehicle-related objectives which can be imposed upon 
subsystem level equipment and subsystem responsibilities include the following: 

• OCS should be largely autonomous of ground control. 

• Crew participation in routine checkout functions should be minimized. 

• The design should be modular in both hardware and software to 
accommodate growth and changes . 

• OCS should be integrated with, or have design commonality with, 
other onboard hardware or software . 

• The OCS should use a standard hardware interface with equipment 
under test to facilitate the transfer of data and to make the system 
responsive to changes. 

• Failures should be isolated to an LRU such that the faulty unit can be 
quickly removed and replaced with an operational unit. 
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• A Caution and Warning System should be provided to facilitate crew 
warning and automatic "safing" where required. 

• Provisions must be included to select and transmit any part or all of 
the OCS test data points to the ground. 

To attain these objectives via the use of an Onboard Checkout System which 
is integrated with the Data Management System, checkout strategies have been 
developed which are tailored to each Space Station subsystem. 

Special emphasis has been applied to a strategy for checkout of redundant 
elements peculiar to each subsystem. The degree to which each of these functions 
is integrated into the DMS is also addressed. 

4. 1. 1 SPACE STATION SUBSYSTEMS 

Each major Space Station subsystem was examined with respect to the re- 
quired checkout functions. The checkout functions associated with each subsystem 
are identified and analyzed as to their impact on the onboard checkout task. The 
functions considered are those necessary to verify operational status, detect and 
isolate faults, and to verify proper operation following fault correction. Specific 
functional requirements considered include stimulus generation, sensing, signal 
conditioning, limit checking, trend analysis, and fault isolation. 

4. 1. 1. 1 RF Communications Subsystem 

The RF Communications Subsystem (RFCS) contains the receivers, trans- 
mitters, power amplifiers, transponders, modems, and antenna systems to pro- 
vide radio frequency communications between the Space Station and the ground, 
DRSS, Shuttle, free-flying experiment modules, and EVA crewmen. The sub- 
system operates in the S, K u , and VHF bands. 

4. 1. 1. 1. 1 Checkout Functions 

Fault detection in the RF Communications Subsystem utilizes both operation- 
al monitoring and specific functional test routines. The operational monitoring 
takes place continuously while the system is in use and involves both the onboard 
and ground crews to a great extent. Assessment of system performance is made 
in much the same way one "checks out" his home communications equipment such 
as telephone and television, i. e. , by listening to or looking at the output. Such 
tests are somewhat gross and subjective of course, and must be augmented by 
functional tests which include more precise qualitative analysis of performance. 
These functional tests may be performed on a scheduled periodic basis or as an 
aid to fault isolation in the event of a malfunction. Checkout of portions of the 
system will also be required prior to initiation of certain operations, such as a 
rendezvous and docking. Functional tests generally involve the injection of cali- 
brated test stimuli and evaluation of equipment response. 
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• Stimulus Generation - Checkout of the various S-band, Ku-band, and 
VHF receivers requires the capability to inject RF test stimuli of the 
appropriate frequency and modulation characteristics into the receiver 
front ends and measure the corresponding receiver outputs and Auto- 
matic Gain Control (AGC) levels. Testing of transmitters and of the 
receiver and transmitter modems requires the injection of modulating 
test signals of the appropriate type and format. Stimulus requirements 
are included in Appendix I. 

• Sensing - Sensing requirements associated with the RFCS are tabulated 
in Appendix I. 

The 0-5 Vdc range given for the AGC, RF power, and Voltage Standing 
Wave Ratio (VSWR) levels are conditioned sensor output levels rather 
than "raw" signal ranges and reflect the selected RFCS design approach 
of providing integral signal conditioning at the LRU level. Similarly, 
the bilevel status indicator parameters represent a variety of "raw" 
parameters including mode selections, switch positions, presence of 
primary power, and presence of input and/or output modulation. The 
selector switch position parameters indicate the position of multi posi- 
tion switch elements such as channel selectors and antenna switches. 
These parameters are internally encoded such that a twelve-position 
switch, for example, is represented in the form of a four-bit binary 
word. 

• Signal Conditioning - The measurement signal conditioning for the RFCS 
is included as an integral portion of the subsystem at the "black box" or 
LRU level. The measurements are therefore directly compatible with 
the data management subsystem. 

• Limit Checking - Limit checks of the continuous or random type have 
limited applicability in the RFCS. This is due to the fact that the ma- 
jority of the significant subsystem performance parameters, such as 
RF output power, are meaningful only when the equipment is actually 
transmitting or, as in the case of receiver sensitivity (AGC) measure- 
ments, when a calibrated input signal is present. Limit testing oppor- 
tunities are therefore largely confined to periodic test situations where 
the necessary conditions can be established. 

• Trend Analysis - Application of trend analysis techniques to selected 
RFCS measurements is potentially useful in detecting degradation and 
impending failures in such equipment as transmitters and receivers. 

In particular, the RF power output and VSWR of the transmitters 
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and the AGC level of the receivers are good performance indicators and 
are amenable to such analysis. Care must be exercised, however, to 
assure proper correlation between these measurements and the various 
factors which influence them. Meaningful receiver sensitivity data, for 
example, is highly dependent upon accurate calibration of the input test 
signal. The maintenance of sufficiently accurate calibration of test 
stimuli and measurement equipment over a long term orbital mission 
is a problem not previously encountered in the space program and will 
require careful consideration. 

4. 1. 1. 1. 2 Redundant Element Checkout 

Redundancy in the RFCS is in the form of functional redundancy, as typified 
by the capability to communicate with the ground either directly or via DRSS, and 
in duality of systems as in the case of the dual antenna systems. These dual or 
functionally overlapping areas of equipment are independent of each other, however, 
and therefore do not constitute redundancy in the normal switchable or parallel 
equipment sense. As such, no unique checkout problems exist. 

4. 1. 1. 1.3 Integration with Data Management Subsystem 

Stimulus requirements for the RFCS include modulated S-band, K u -band, 
and VHF RF signals, analog signals, and digital inputs. The RF signals in par- 
ticular are relatively complex and are unique to the subsystem. These are there- 
fore generated by equipment internal to the subsystem. The control of these 
signals is a function of the DMS. The various analog signals (i.e. audio, video, 
etc. ) required for modulation testing are likewise generated internally under DMS 
control. Digital test inputs required for checkout of the PM modems and exciters 
are supplied directly by the DMS via the data bus. 

Measurement sensors and signal conditioning for the Communications Sub- 
system are provided as an integral part of that subsystem. The signal interface 
between the RFCS and the DMS is in the form of standard 0-5 Vdc signals for each 
measurement. 
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4.2 INTEGRATED CHECKOUT STRATEGY 

This analysis identifies the integrated checkout functions associated with 
Space Station subsystems during the manned orbital phase of the mission. These 
functions are depicted in Figure 4-1 and are those required to ensure overall 
availability of the Space Station. Characteristic of integrated testing is the fact 
that the test involves subsystem interfaces, and, therefore, test objectives are 
associated with more than one subsystem. 

4. 2. 1 INTEGRATED STRATEGY 

Six checkout functions have been identified: 

• Caution and warning 

• Fault detection 

• Trend analysis 

• Operational status 

• Periodic checkout 

• Fault isolation 

These functions represent a checkout strategy of continuous monitoring and 
periodic testing with eventual fault isolation to a line replaceable unit (LRU). 
Under this aspect the functions are grouped as - 

CONTINUOUS MONITORING PERIODIC TESTING FAULT ISOLATION 

• Caution and warning • Automatic tests • Localize to SS 

• Fault detection • Operational • Isolate to RLU 

• Trend analysis Verification 

• Operational status 
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General characteristics of these groups are defined below: 

4. 2. 1.1 Continuous Monitoring 

Continuous monitoring is not a test per se. It is a concept of continuously 
sampling and evaluating key subsystem parameters for in/out -of -tolerance con- 
ditions. This evaluation does not necessarily confirm that the subsystems have 
failed or are operating properly. The evaluation is only indicative of the general 
status of the subsystems. For example, a condition exists where the integrated sub- 
systems are indicating in-limit conditions, but during the next series of attitude con- 
trol commands, an error in Space Station position is sensed and displayed. Since 
three subsystems, DMS, GN&C, and P/RCS, are involved in generating and 
controlling the Space Station attitude, a "positional error" malfunction is not 
directly related to a subsystem malfunction. The malfunction indication is only 
indicative of an out-of-tolerance condition of an integrated function. Final resolu- 
tion of the problem to a subsystem and eventually to LRU will require diagnostic 
test-procedures that are separate from the continuous monitoring function. 

There are situations in which the parameters being monitored are intended 
to be directly indicative of the condition of a subsystem or an LRU. Examples of 
these include tank pressures, bearing temperatures, and power source voltages. 
However, even in these simpler cases when a malfunction is detected, an integrated 
evaluation will be performed to ascertain that external control functions, transducers, 
signal conditioning, and the DMS functions of data acquisition, transmission, and 
computation are performing properly. This evaluation will result in either a sub- 
stantiation of the malfunction or identification of a problem external to the param- 
eter being monitored. 

Figure 4-1 shows the logic associated with each function in the continuous 
monitoring group, as well as the integrated relationships between these and the 
total checkout functions. The caution/warning and fault detection functions are 
alike in their automatic test and malfunction detection approaches, but are differ- 
ent in terms of parameter criticality and malfunction reaction. The caution/warn- 
ing function monitors parameters that are indicative of conditions critical to crew 
or equipment safety. Parameters not meeting this criticality criteria are handled 
as fault detection functions. Figure 4-1 shows that in the event of a critical mal- 
function, automatic action is initiated to warn the crew and sequence the sub- 
systems to a safe condition. Before this automatic action is taken, the subsystems 
must be evaluated to ascertain that the failure indication is not a false alarm and 
that the corrective action can be implemented. After the action is taken, the sub- 
systems must be evaluated to determine that proper crew safety conditions exist. 

Since automatic failure detection and switching can be integral to subsystem de- 
sign (self-contained correction) and subsystems can be controlled by the operation- 
al software or manual controls, it is imperative that the status of these events be 
maintained and that the fault detection and correction software be interfaced with 
the prime controlling software. For malfunctions that are not critical, the crew 
is notified of their occurrence, but any subsequent action is initiated manually. 
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Figure 4-1. Integrated Checkout Functional Flow 
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The next continuous monitoring function, trend analysis, automatically ac- 
quires data and analyzes the historical pattern to determine signal drift and the 
need for unscheduled calibration. It also predicts faults and indicates the need 
for diagnostic and fault isolation activities. An example of a parameter in this 
category is the partial pressure of nitrogen. Nitrogen is used to establish the 
proper total pressure of the Space Station. Since it is an inert gas, the only make- 
up requirements are those demanded by leakage or airlock operation. The actual 
nitrogen flow rate is measured, and calculations are performed which make 
allowances for normal leakage and operational use. When these calculations 
indicate a trend toward more than anticipated use, the crew is automatically 
notified and testing is initiated to isolate the problem to the gas storage and 
control equipment or to an excessive leak path. The historical data is not only 
useful in predicting conditions but is also useful in providing trouble-shooting clues. 
The data might reveal, for example, that the makeup rate increased significantly 
after the use of an airlock. This could lead directly to verifying excessive seal 
leakage. 

The final continuous monitor function is in operational status. This function 
is performed by the crew and is nonautomatic with the exception of the DMS com- 
puter programs associated with normal Space Station operational control and 
display functions. The concept of continuous monitoring recognized and takes 
advantage of the crew's presence and judgment in evaluating Space Station per- 
formance. In many instances the crew can discern between acceptable and un- 
acceptable performance, and they can clearly recognize physically-damaged 
equipment or abnormal conditions. 

4. 2.1.2 Periodic Testing 

As opposed to continuous monitoring, periodic testing is a detailed evalua- 
tion of how well the Space Station subsystems are performing. Figure 4-1 shows 
that periodic testing is not accomplished by any one technique. Rather, a com- 
bination of operational and automatic test approaches is employed. The actual 
operational use of equipment is often the best check of the performance of that 
equipment. Operation of Space Station equipment and use of the normal operating 
controls and displays will be used in detecting faults and degradation in the sub- 
systems. This mode of testing is primarily limited to that equipment whose 
performance characteristics are easily discernible, such as for motors, lighting 
circuits, and alarm functions. 

Automatic testing is performed in two basic modes: 

• With the subsystems in an operating mode, the DMS executes a diagnos- 
tic test procedure which verifies that integrated Space Station functions 
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are being properly performed under normal interface conditions in 
response to natural or designed stimulation. This mode of testing 
allows the evaluation of Space Station performance without interrupting 
mission operations. 

• For those situations where the integrated performance or interface 
compatibility between subsystems cannot be determined without known 
references or control conditions, the DMS will execute a diagnostic 
procedure in a test mode. In this mode, control, reference, or bias 
signals will be switched in or superimposed on the subsystems to allow 
an exact determination of their performance or localization of problem 
between the interfaces. Since the test mode may temporarily inhibit 
normal operations, the DMS must interleave the test and operational 
software to maintain the Space Station in a known and safe configuration. 

The scheduled automatic tests are performed to verify availability or proper 
configuration of "on-line" subsystems, redundant equipment, and alternate modes. 

• Periodic Verification of "On-Line" Subsystems - The first checkout 
requirement is a periodic verification that on-line subsystems are 
operating within acceptable performance margins. The acceptable 
criteria for this evaluation is based on subsystem parameter limits and 
characteristics exhibited during Space Station factory acceptance or 
pre-flight testing. The rejection criteria and subsequent decision to 
repair or reconfigure subsystems is based on the criticality of the 
failure mode. If the subsystems appear to be operating properly, but 
the test clearly indicates an out-of-tolerance condition, then one of the 
following alternatives must be implemented: 

If the failure mode is critical, the crew normally takes immediate 
action to isolate and clear the problem. 

If the failure mode is not critical, the crew can take immediate 
action, schedule the work at a later time, or wait until the condi- 
tion degrades to an unacceptable level. 

• Redundant Equipment Verification - A second checkout requirement is 
verifying that standby, off-line, or redundant equipment and associated 
control and switching mechanisms are operable. The acceptable/re- 
jection criteria for these evaluations is identical to those for normally 
operating equipment. A primary distinction of this function is that 
equipment may have known failures from previous usage or tests. This 
situation occurs when the crew has knowledge of a failure but has not 
elected to perform the necessary corrective action; The checkout 


4-9 



function then becomes one of equipment status accounting and main- 
tenance/repair scheduling. The status information is interlocked with 
mission procedures and software to preclude activation of failed units 
while they are being repaired or until proper operation following repair 
is verified. 

• Alternate Mode Verification - The third checkout function is verifying the 
availability of alternate modes of operation. This function is essentially 
a confidence check of the compatibility of subsystems’interaction and 
performance during and after a change in the operating mode. To some 
extent this function overlaps with redundant equipment verification, but 
is broader in scope in that it verifies other system-operating character- 
istics. For example, some modes will involve manual override or 
control of automatic functions or automatic power-down sequences. 

4. 2.1.3 Fault Isolation 

Fault isolation to an LRU is a Space Station goal. As shown in Figure 4-1, 
fault isolation testing is initiated when malfunction indications cannot be directly 
related to a failed LRU. The integrated test functions associated with fault isola- 
tion are localizing a malfunction to a subsystem or to an explicit interface between 
two subsystems and identifying the subroutine test necessary for LRU isolation. 

In structuring this relationship between integrated subsystem tests for fault local- 
ization and subroutine tests for fault isolation, the DMS, in conjunction with the 
test procedure documentation, must establish an effective man-machine interface 
so that in the event of an unsolved malfunction the crew will be able to help evalu- 
ate the condition and determine other test sequences necessary to isolate the 
problem. To accomplish this requirement, the DMS must be capable, of displaying 
test parameters and instructions in engineering units and language and be capable 
of referencing these outputs to applicable documentation or programs that correl- 
ate test results to corrective action required by the crew. 
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Section 5 


ONBOARD CHECKOUT TEST DEFINITIONS 
5. 1 SUBSYSTEM TEST DEFINITIONS 


The on-orbit tests required to insure the availability of the Space Station 
subsystems are defined herein. Also delineated are the measurement and 
stimulus parameters required to perform these tests. Two discrete levels of 
testing are defined, i. e. , continuous status monitoring tests for fault detection of 
critical and noncritical parameters, and subsystem fault isolation tests for 
localization of faults to a specific Line Replaceable Unit. In addition to these two 
levels, tests are defined for periodic checkout and calibration of certain units, 
and parameters requiring analysis of trends are defined. 

Due to the software module approach to DMS checkout, it was deemed 
necessary to estimate the CPU time and memory required to implement these 
modules along with an assessment of the services required from an Executive 
Software System to control the checkout. 

These test descriptions, measurement, and stimulus information provided 
for each subsystem, and the software sizing information provided for the Data 
Management System provide the data required to estimate the checkout impact 
on the DMS software and hardware. Table 5-1 is a summary of the measurement 
and stimulus requirements for the Space Station. 

The RF Communications Subsystem contains the receiver, transmitters, 
power amplifiers, transponders, modems, and antenna systems to provide radio 
frequency communications between the Space Station and the ground, DRSS, Shuttle, 
free-flying experiment modules, and EVA crewmen. The subsystem operates in 
the S, K u , and VHF bands. 

On-orbit checkout activities required to insure the availability of the sub- 
system include monitoring of its normal operational outputs, performing periodic 
checks, and selecting fault isolation routines associated with the loss of a com- 
munications function. In addition, some trending and calibration are required. 
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Measurement/Stimulus Summary 



The measurements and stimuli associated with these checkout activities are 
identified in Appendix 1-5 of the Task 1 Final Report. All analog and RF stimuli 
are generated by the subsystem but controlled by the DMS. Conditioning of sensor 
outputs is also integral to subsystem LRUs and results in all measurements being 
compatible with DMS data acquisition elements. 

Go/No-Go decision outputs are provided where possible for checkout of the 
RF communications subsystem. The acceptance/rejection criteria associated with 
the occurrence of an event such as primary power ON/OFF, modulation output 
present, switch position selected, and channel or mode selected are straight- 
forward. A bilevel output is either present or absent and would be indicated by 
two distinct voltage levels. An absolute acceptance/rejection criterion as- 
sociated with analog responses such as RF power output level, VSWR level, and 
AGC output level, on the other hand, is more difficult to establish. This is due to 
design variances between equipment and the accuracy of the individual measure- 
ment. For instance, the K u -band PA may be specified to deliver not less than 
10 watts of RF power, and this would be indicated by a 4. 0-volt analog output. A 
tolerance of + 10 percent due to design and measurement variances results in a 
range of outputs from 3. 6 to 4. 4 volts. Reliance on an absolute level could result 
in the rejection of a unit that is operating normally. Therefore, the analog outputs 
should be utilized primarily for trend analysis purposes. 

The checkout of the RF Communications Subsystem can be automatically 
controlled by the DMS and should require minimal crew participation. The crew 
participation would be limited to calling up preprogrammed fault isolation and 
periodic checkout routines and interpretation of anomalies. 
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5. 1. 1 STATUS MONITORING 


During normal operation of the subsystem, only two different types of param- 
eters are monitored on a nearly continuous basis. These are the transmitter or 
exciter and power amplifier RF power output levels, and the receiver AGC output 
levels. These noncritical parameters are sampled once per minute. This sampling 
can be performed during normal operation of the subsystem without the need for 
stimuli. In the case of AGC output level, for example, the signal stimulus is the 
modulated RF signal transmitted by the Shuttle, free-flying experiment module, 
etc. Since the AGC level varies as a function of received signal strength, this 
parameter should be compared on a sample-to-sample basis to detect large changes 
in output level. Unless a failure occurs, the RF power output should stay fairly 
constant during a normal operating period. For power output levels, the RF output 
of the exciter associated with the power amplifier provides the required input 
stimulus. Measurement of power output during normal operation actually provides 
a better indication of overall performance than would a check of the power amplifier 
by itself. 

Although several parameters are monitored continuously during subsystem 
operation, none of these can be classified in a caution or warning category. 

5.1.2 TREND ANALYSIS 

To detect graceful degradation in Communication Subsystem receivers, 
exciters, power amplifiers, and transmitters, internally generated AGC, RF 
stimuli, AGC outputs, and power outputs are periodically sampled. The internally 
generaged RF stimuli are necessary to obtain an accurate indication of the AGC 
output levels. Sampling should occur approximately once per day for equipment 
utilized to support the Shuttle, free -flying experiment modules, and direct-to- 
ground links. Equipment that supports the primary link between the Space Station 
and the relay satellite, on the other hand, should be sampled about once per hour. 

5. 1. 3 PERIODIC CHECKOUT AND CALIBRATION 

The only calibration functions that have been identified are the RF power 
levels at the high-gain antenna feeds and low-gain antenna elements. The measure- 
ment of RF System insertion loss is required after the replacement of an LRU in 
the RF Transmission System to verify that the unit has been properly replaced. 


Periodic checks of subsystem status and availability are performed at once- 
per-month and one-per-week intervals. The monthly checks should be performed 
several days ahead of anticipated operational usage. This primarily pertains to 
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that equipment utilized to support the Shuttle and experiment modules. During the 
artificial-gravity portion of the mission, the S-band equipment utilized for the 
direct-to-ground link should be checked once per week. After completion of arti- 
ficial gravity, these checks can be performed at monthly intervals. Week-by-week 
checks should also be performed on the transmitters (exciters and power ampli- 
fiers), receivers, signal interface modems, and High Gain Antenna System utilized 
for the Space Station relay satellite K u -band link. 

The procedure for periodic checkout requires systematic checks performed 
on a group of LRUs associated with a particular mission support function. Except 
for the High Gain Antenna System, the following represents a periodic checkout 
procedure for a typical set of RF link equipment. 

1. Apply primary power to all units. 

2. Monitor primary power indication. 

3. Check for completion of power amplifier warm-up cycle. 

4. Monitor exciter, power amplifier, and antenna feed RF power 
output levels. 

5. Monitor VSWR levels at power amplifier output and antenna feed. 

6. Apply modulation input stimulus. 

7. Monitor modem and exciter outputs for presence of modulation. 

8. Apply modulated RF signal at input to low noise preamplifier. 

9. Monitor preamplifier output level and receive AGC output level. 

10. Monitor modem and receiver outputs for presence of modulation. 

11. Switch to redundant preamplifier and repeat steps 8, 9, and 10. 

12. Apply known antenna position control input. 

13. Monitor antenna position output indication and compare with input 
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5.1.4 FAULT ISOLATION 


Fault isolation of the RF Communications Subsystem is performed on a sys- 
tematic basis on a group of LRUs that are associated with the loss of a particular 
function. A typical fault isolation flow diagram is depicted in Figure 5-1 for the 
case where no video signal is received from the ground. This particular routine 
culminates in the identification of an LRU to be replaced or calls for further 
testing of the High Gain Antenna System or interfacing portions of the Data 
Management Subsystem. 

5.2 INTEGRATED TEST DEFINITION 

The task of ensuring overall Space Station availability is primarily dependent 
upon the proper structuring of individual subsystem tests. The ability to test the 
subsystems independent of other subsystems is directly related to the number and 
types of interfaces. As shown in Figure 5-2, the DMS and Electrical Power Sub- 
systems (EPS) interface with every other Space Station subsystem. In addition, 
the EC/LS Subsystem provides cooling to most of the electronic packages. 
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Figure 5-1. 


Typical Fault Isolation Routine Flow Diagram 
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This situation demands that in constructing the test for a subsystem these inter- 
faces be taken into account so that erroneous or ambiguous test results will not 
be obtained. In other words, before detailed subsystem fault isolation tests are 
initiated, a higher level of testing should be performed to verify that all interfaces 
and Space Station conditions that influence the subsystem are proper. Properly 
designed, these higher -level tests will (1) indicate what Space Station conditions 
must be verified, maintained, or changed; (2) localize the malfunction to a single 
subsystem; and (3) identify the subroutine test necessary for fault isolation. 

Since the DMS interfaces with all of the Space Station subsystems and is 
used as the OCS, it would appear that all of the tests would be integrated. How- 
ever, this is not a proper interpretation. When the DMS is used to verify the 
performance of another subsystem, it must first establish itself as a test standard 
against which the subsystem parameters are compared. Subsequent to this veri- 
fication, the test is dedicated to the evaluation of the subsystem. This test would 
be considered as an independent test since the objective of the test was to verify 
the subsystem and not the DMS. For a test to be considered as an integrated test 
it must meet one or more of the following conditions: 

• Test objectives associated with more than one subsystem 

• Test involves subsystem interfaces 

• Test requires proper operation of other subsystems 

In several cases, the DMS must simultaneously perform the dual role of 
OCS and functional elements. As an example, the DMS has a functional interface 
with the GN&C and Prop Subsystems for the computation of guidance equations and 
the execution of commands to the control actuators. When this functional closed 
loop is being tested, the DMS must, in addition to performing its normal functions, 
execute the test routine. For this type of integrated test there must be an intrinsic 
relationship between the operational and test software. This relationship must be 
carefully considered in structuring the integrated tests since unstable or inter- 
mittent performance may be detected only in the exact operating mode under 
closed-loop conditions. The number of integrated tests is not extensive due to the 
approach of minimizing the different types of interfaces between Space Station sub- 
systems. For example, interfaces between the DMS and other subsystems are 
largely standardized. As a result, relatively common tests can be designed for 
verification of the multitude of DMS subsystem interfaces or for localization of a 
fault to one side of a DMS subsystem interface. A special integrated test that has 
been identified is discussed in the following paragraph. 
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5.2.1 GN&C/DMS/COMM 


The DMS has a functional interface with the GN&C and COMM Subsystems 
for the pointing and control of antennas. The GN&C sends navigation and attitude 
information to the DMS which in turn uses it to compute antenna pointing positions 
and slewing rates. Once computed, the DMS transfers these commands to the 
antenna actuators in the Communication Subsystem. 

Localizing a malfunction to one of the three subsystems will be performed 
in a manner similar to that described in subsection 6. 2. 1 of the Task 1 Final 
Report. The DMS will verify receipt of proper attitude and navigation data from 
the GN&C Subsystem, check its capability to operate on and transform the data 
into appropriate antenna commands, and verify the transmission of the control 
data to the Communication Subsystem. Verification of proper response and 
operation of Communication Subsystem equipment will be aided by the switching 
and use of redundant transmitters and receivers. 
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Section 6 


SOFTWARE 

6.1 GENERAL CONSIDERATIONS 

The recommended software checkout startegy involves a sequence of 
detecting faults, isolating faults to a failing LRU or LRUs, and reconfiguring the 
system to continue operation while the failures are being repaired. 

This recommendation was developed by evaluating each subsystem with 
respect to the three general requirements of fault detection, fault isolation, and 
reconfiguration. 


Fault detection incorporates both the recognition of failure occurrence, and 
the prediction of when a failure can be expected to occur. The Remote Data ' 
Acquisition Units (RDAUs) continually check selected test point measurements 
against upper and lower limits, and notify the executive on an exception basis when 
a limit is exceeded. This approach avoids occupying the central multi-processor 
with the low-information task of verifying that measurements are within limits. 

Trend analysis is a fault detection technique recommended for predicting the 
time frame during which a failure can be anticipated. Data is acquired on a basis 
of time or utilization, and compared with previous history to determine if a "trend" 
toward degraded performance or impending failure can be detected. 

Another checkout requirement evaluated for each subsystem is periodic 
testing. This type of test is provided to exercise specific components at extended 
time intervals or prior to specific events, to assure operational integrity. In the 
event that a failure is detected, the periodic test will isolate to the failing Line 
Replaceable Unit (LRU) and accomplish recertification after a repair operation. 

Calibration of specific subsystem components will be required periodically, 
or subsequent to a repair and/or replace operation. The techniques involved are 
unique to the individual component; and, in some cases, require the acquisition of 
operational data. 

Fault isolation is required when a fault is detected. When a particular fault' 
provides an indication that a life critical failure has occurred, the fault isolation 
routines are automatically initiated. If the failure does not represent an immediate 
danger to the vehicle occupants, the crew is notified and they will initiate the fault 
isolation modules at their convenience. 
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The basic requirements of the fault isolation function is to analyze the avail- 
able information relevant to a problem, and identify the LRU which is responsible 
for the anomaly. 

Three basic approaches to meeting this requirement were considered. These 

are: 

• Analyze each fault as an independent problem 

• Analyze each fault with a state matrix which defines the possible error 
states of the subsystem 

• Associate each fault with a specific subsystem, and evaluate that 
subsystem in detail 

The third approach was selected on a basis of software commonality and cost 
effectiveness. The complexity associated with the testing can be reduced by locali- 
zation of the logic associated with the analysis of the subsystem in a unique package. 
The software commonality will result in reduced software development and main- 
tenance costs, while incl*easing the reliability of the software. 

The fault isolation software is structured modularly for compatibility with 
the hardware structure of the subsystem. Checkout modules evaluate the per- 
formance of a specific portion of the subsystem. A convenient division for this 
modular structure is at the assembly level or functional area. A program module 
which can determine and control the sequence in which these checkout modules are 
executed is also required for each subsystem. 

Subsequent to fault detection, the software associated with the subsystem 
which is most likely to contain the error will be activated. 

The subsystem software will analyze the error indication, and initiate a 
sequence of checkout modules to isolate the problem. If successful, the crew is 
notified regarding the Line Replaceable Unit (LRU) to be replaced. If an error 
cannot be identified, the crew is informed of the situation and has an option to 
execute the periodic test of the subsystem. 

After a fault has been isolated, reconfiguration software restores the 
functional capability of the subsystem. This is most commonly accomplished by 
exchanging a redundant element for the failing unit, or by defining an alternate 
path to accomplish the required function. 

The Task 2 Final Report of the basic onboard checkout techniques study 
provides descriptions of the software requirements, definitions and design in 
addition to detailed flow charts of specific checkout routines. 
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6. 2 SPACE STATION SUBSYSTEM 


This section provides performance and design requirements for the Commun- 
ications Subsystem checkout programs to be used for the Space Station during pre- 
flight testing and while in orbit. The detail to which these requirements are 
developed is a function of the engineering design details available in the Phase B 
Space Station studies. 

The checkout functions identified are those for trend analysis, operation 
interface, fault isolation, periodic check, and calibration. Fault detection is 
feasible with human interface and the RDAU preprocessor; therefore, it is not 
identified as a checkout program function. However, management of the RDAU 
fault detection facilities is under control of the checkout executive program. 

The technical aspects of the Communication Subsystem checkout programs 
are described. Modularization concepts are utilized extensively in identifying the 
computer program components. Under the assumption that just as the Communi- 
cations Subsystem itself is modularized, in the final implementation, the computer 
programs will be also. The functions, structures, processing, input, output, and 
data base requirements of the computer program components are discussed. 

The Communications Subsystem requires trend analysis to assess assembly 
performance based on past history. Operation interface is used to enable and dis- 
able the RDAU fault detection capability, as well as to initiate certain forms of 
trend analysis. Fault isolation is required to identify the failed LRU or LRU 
group, and to assess assembly capability prior to use. Periodic check functions 
augment and cross-check the assessments made by fault isolation. Calibration 
verifies the operational characteristics of certain assemblies after LRU replace- 
ment. 

6. 2. 1 SYSTEM REQUIREMENTS 

Continuous monitoring is performed only for the non- critical measurements 
associated with RF power output levels and AGC output levels. These measure- 
ments provide the only means of automatic fault detection by the RDAU preprocessor 
technique. Fault detection relies extensively on human evaluation of operating 
results, in addition to RDAU limit checking. 

Stimuli are required prior to making certain trend analysis measurements, 
and must be applied when the associated assembly is not providing an operational 
function. 

Fault isolation is performed on a group of LRUs which are associated with 
the loss of a particular function. 
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After LRU replacement has been performed in the RF transmission system, 
which consists of the signal path from the power amplifier outputs through the 
antennas, the RF power level at the antennas is used for calibration purposes. 

6.2.2 OPERATIONAL REQUIREMENTS 

The communications checkout programs required for trend analysis, opera- 
tion interface, fault isolation, periodic check, and calibration are discussed in the 
following sections. 

6. 2. 2. 1 Trend Analysis Function 

The trend analysis checkout programs are used to periodically sample 
selected RF and AGC measurements for the purpose of detecting degraded per- 
formance prior to the time that the fault might otherwise be detected. 

Input consists of single test point measurements and the intermediate results 
obtained after the last sample. In the case of certain AGC test points, output con- 
sists of stimuli to supply a reference for the measurement. Other output consists 
of a checkpoint just prior to termination, and parameters passed to other checkout 
functions such as fault isolation. 

Information processing consists of averaging a series of measurements, 
comparing the most recent measurement to the average, and storing averages for 
later retrieval upon request and for use in the next cycle. A trend analysis func- 
tion for RF power test points is initiated by the executive at a specified rate. For 
AGC test points, the trend analysis function is initiated by the shutdown program, 
since trending must be done during periods of inactivity because of the stimulus 
required. Executive checkpoint services are used to store results after each 

cycle. Restart services of the executive are employed to begin each successive 
cycle. 


The trend analysis methods required for the Communications Subsystem are 
as follows: 

1. Provide stimulus and make measurement, comparing with the average 
of 30 previous measurements. Retain, for retrieval on an as-required 
basis, 30 averages. 

2. Compare measurement with the average of 48 previous measurements. 
Retain, for retrieval on an as-requested basis, the daily average for 
three months. A stimulus may or may not be required prior to the 
measurement. 
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In Table 6-1, the trend analysis requirements of the Communications Sub- 
system are summarized. Auxiliary storage requirements for data storage, 
assuming three checkpoints are available at any time, is approximately 5. 7K 
words. 

6. 2. 2. 2 Operation Interface Function 

While fault detection is done by means other than software, there is a check- 
out program involvement in activating and deactivating the fault detection mechanism 
provided by the RDAU preprocessor. This is the operation interface function of com- 
munication checkout. 

Input consists of the symbolic identity of the assembly being activated or de- 
activated, such as the K u -band FM transmitter. Output consists of a memory up- 
date for the RDAUs which are connected to the status monitoring test points of the 
assembly, 

Information processing consists of identifying the RDAUs involved, and either 
masking or unmasking the RDAU channels which measure the status test points. 

While the assembly is on standby, the channel is masked to prevent a limit check 
interrupt which might give a false error indication. After the assembly has been 
activated, the channel is unmasked to allow limit checking to proceed. 

For assemblies requiring procedures beyond simply applying or disconnecting 
electrical power, special modules are utilized. For example, these modules supply 
logic necessary to complete the warmup cycle of a power amplifier or to assure 
signal acquisition. Other assemblies require an AGC stimulus in order that the 
trend measurement can be made. Since this stimulus must be made while the 
assembly is not in normal operational use, the shutdown routine will invoke the 
trend analysis program, provided sufficient time has elapsed since the last mea- 
surement. 

6. 2. 2. 3 Fault Isolation Function 

Upon detection of a fault by the crew, ground, or RDAU's, the fault isolation 
functions are invoked to identify the failed assembly or LRU. Although automatic 
isolation to the failed LRU is attempted, in cases such as the high gain antenna 
group, it is only feasible to isolate to a larger assembly because of the instrumen- 
tation problems involved. In some cases, additional test points would increase 
the system insertion losses; therefore increasing the power required to compen- 
sate for these losses, compared with that required for operational purposes. 

No unusual input or output requirements for fault isolation beyond those re- 
quired for GN&C, Structures, EP and EC/LS Subsystems have been identified. 
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Number of 

Trend 

Stimulus 

Measure- 

Averages and 
Mea sur erne nts 
Retained Per 


Applications 

Method 

R equired 

ment Rate 

Test Point 

S-Band Video Receiver AGC 

10 

1 

Yes 

1 /day 

61 

S-Band Data Receiver AGC 

10 

1 

Yes 

1 /day 

61 

S-Band PM Receiver AGC 

2 

2 

Yes 

1 /hour 

139 

Ku-Band FM Exciter RF Power 

2 

2 

No 

1 /hour 

139 

S-Band FM Receiver AGC 

2 

2 

Yes 

1 /hour 

139 

Ku-Band PA RF Power 

5 

2 

No 

1 / hour 

139 

Ku-Band PM Exciter RF Power 

5 

2 

No 

1 /hour 

139 

S-Band PM Transponder AGC 

2 

1 

Yes 

1 /day 

61 

S-Band PM Transponder RF Power 2 

2 

No 

1 /hour 

139 

S-Band PA RF Power 

2 

2 

No 

1 /hour 

139 

S-Band FM Exciter RF Power 

2 

2 

No 

1 / hour 

139 

VHF Voice/Ranging RF Power 

2 

2 

No 

1 / hour 

139 

VHF Voice/Ranging AGC 

2 

1 

Y es 

1 /day 

61 

VHF Data Receiver AGC 

2 

1 

Yes 

1 /day 

61 

VHF FM Transmitter RF Power 

3 

2 

No 

1 /hour 

139 

VHF FM Receiver AGC 

3 

1 

Yes 

1 / day 

61 

VHF Data Transmitter RF Power 

2 

1 

Yes 

1 /day 

61 


Table 6-1. Communications Trend Analysis 



Information processing for each fault isolation function follows the same form 
identified in the referenced Space Station OCS Interim Reports. In most cases, 
communications fault isolation requires exclusive use of the LRUs associated with 
the function which is suspected of containing a fault. 

The fault isolation modules for the Communications Subsystem relate to 
functions such as video reception, voice transmission, etc. These routines are 
then applied to the hardware assembly groups of S-band low gain, K u -band low 
gain, high gain, and VHF low gain shown in Figure 6-1. Further breakdown of 
each group, detailing LRU interfaces is shown in Figure 6-2 through Figure 6-5. 

In each block of the LRU interface diagrams, the LRU quantity is indicated in 
parentheses. 

The LRUs associated with the VHF low gain group are shown in Figure 6-2. 
The fault isolation functions are identified below, with the LRU coverage for each 
function indicated in parentheses: 

• VHF RF Transmission (VHF low-gain antennas, VHF diplexers, VHF 
multiplexer /power divider/switches) 

• VHF Voice (VHF voice XMTR/RCVRs, signal modems) 

• VHF PM Data (VHF PM Data XMTR/RCVRs) 

• VHF Voice/Ranging (VHF FM voice/ranging XMTR/RCVRs, voice 
transceiver modems, ranging modems) 

The LRUs associated with the K u -band low-gain group are shown in Figure 
6-3. The fault isolation functions are identified below, with the LRU coverage for 
each function indicated in parentheses: 

• K u -Band RF Transmission (K u -band low-gain antennas, K u -band pre- 
amp/mixer/diplexer/switches, S-band multiplexers and circulators) 

• S-Band Data (S-band data receivers) 

• S-Band Video (S-band video receivers, video receiver modems) 

The LRUs associated with the S-band low-gain group are shown in Figure 
6-4. The fault isolation functions are identified below, with the LRU coverage 
for each function indicated in parentheses: 

• S-Band RF Transmission (S-band low-gain antennas, S-band 
triplexer/ switches ) 

• S-Band Transponder (S-band PM Transponders, transponder modems) 

• S-Band FM Transmitter (S-band power amplifiers, S-band FM 
exciters, transmitter modems) 
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DIGITAL AND ANALOG DATA BUSES 


Figure 6-1. Communications Assembly Group Interfaces 
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Figure 6-3. LRU Interface Diagram K u -Band Low-Gain Group 
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The LRUs associated with the high-gain group are shown in Figure 6-5. The 
fault isolation functions are identified below, with the LRU coverage for each func- 
tion indicated in parentheses: 

• Reception (main reflector/feeds, acquisition reflector/feeds, pseudo 
monopulse comparators, external RF switches, K u -band TDA/mixers/ 
L.O.'s, S-band quadriplexers and power dividers, internal RF switches) 

• Transmission (main reflector/feeds, acquisition reflector/feeds, pseudo 
monopulse comparators, external RF switch, K u -band waveguide, Ku- 
band quadriplexers/circulators, internal RF switches) 

• S-Band PM Receiver (S-band PM receivers) 

• S-Band FM Receiver (S-band diplexer, S-band FM receivers, 
receiver modems) 

• Ku-Band High Power (K u -band power amplifiers, K u -band PM 
exciters) 

• K u -Band Low Power (Ku-band PM exciters) 

• FM Transmitter (K u -band diplexer, K u -band power amplifiers, Ku- 
band FM exciters, FM XMTR modems) 

6. 2. 2. 4 Periodic Check Function 

The periodic check functions identified in this section augment the periodic 
tests which can be performed by executing the fault isolation function for an 
assembly group. 

Input consists of test point measurements, as well as configuration, status, 
and limit information from the data base. Output consists of exceptional condi- 
tions displayed to crew or ground, and data base updates where exclusive use of 
the assembly being checked is required. 

Information processing consists of obtaining the limit values from the data 
base, ascertaining that the test point is within these limits, and that the RDAU 
memory contains the proper values. 
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6. 2. 2. 5 Calibration Function 


The calibration functions required for the Communications Subsystem measure 
insertion loss in the RF transmission system, and compare with values which have 
been established in pre-flight and operational evaluations. The RF transmission 
system is defined as those assemblies which form the signal paths between power 
amplifiers and exciters, and the antennas of the Space Station. 

Input consists of test point measurements associated with RF power and the 
Calibration Table. Output consists of messages to the crew. 

Information processing consists of using RF power output at the power amp- 
lifier or exciter side of the RF transmission system, and RF power level at the 
antenna to compute insertion loss in decibels, the most convenient form for human 
interface. Logarithmic calculations required for this function will be performed 
by a library routine written in machine language, and invoked by high-level 
language programs, using the CALL language element. 

6.2.3 INTERFACE REQUIREMENTS 

In this section, program to program, program to data base, and program to 
DMS I/O, assembly interfaces are indicated. 

The checkout program to executive interfaces required for the Communica- 
tion Subsystem are as follows: 

• Data base access is gained through the services of the executive in order 
to control data base changes and to assure the ability to reconfigure 
memory without impacting program performance. 

• Reference to all I/O devices, including those associated with test points, 
is done through executive services in order to keep clerical details in 
the programming language to a minimum. 

• Programs refer symbolically to test points and rely on the executive to 
translate the symbols into actual addresses at execution time by using 
the configuration information maintained in the data base. This assures 
use of the latest hardware configuration without program modification. 

The relationships among the Communications Subsystem checkout functions 
are shown in Figure 6-6. 
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Section 7 


MAINTENANCE 


There are two aspects of maintenance which entered into the basic study. 
Basic maintenance concepts were provided as part of the baseline resulting from 
the Phase B Space Station study; they are discussed in subsection 7. 1 below. 
Additionally, one of the study tasks was aimed at implementation of an onboard 
electronics maintenance capability. The results of that task are summarized 
in subsection 7.2. 

7. 1 BASELINE MAINTENANCE CONCEPTS 


Maintenance concepts defined for Space Station subsystems are intended to 
facilitate their preservation or restoration to an operational state with a minimum 
of time, skill, and resources within the planned environment. 

7.1.1 GENERAL SPACE STATION MAINTENANCE POLICY 

It is a Space Station objective that all elements be designed for a complete 
replacement maintenance capability unless maintainability design significantly 
decreases program or system reliability. This objective applies to all sub- 
systems wherever it is reasonable to anticipate that an accident, wearout, or 
other failure phenomenon will significantly degrade a required function. Estimates 
of mean-time-between-failure, or accident/failure probability, are not accepted 
as prima facie evidence to eliminate a particular requirement for maintenance. 
Should the accident/failure probability be finite, the hardware is to be designed 
for replacement if it is reasonable and practical to do so. 

As a design objective, no routine or planned maintenance shall require use 
of a pressure suit [either EVA or internal vehicular activity (IVA)] . Where 
manual operations in a shirtsleeve environment are impractical, remote control 
means of affecting such maintenance or repairs should be examined. However, 

EVA (or pressure suit IVA) is allowable where no other solution is reasonable, 
such as maintenance of external equipment. 

Time dependency shall be eliminated as a factor of emergency action insofar 
as it is reasonable and practical to do so. This includes all program aspects of 
equipment, operations, and procedures which influence crew actions. When time 
cannot be eliminated as a factor of emergency action, a crew convenience period 
of 5 minutes is established as the minimum objective. The purpose of the con- 
venience period is to provide sufficient time for deliberate, prudent, and unhurried 
action. 
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7.1.2 ONBOARD MAINTENANCE FACILITY CONCEPTS 


In addition to OCS/DMS capabilities, other onboard maintenance support 
facilities provided on the Space Station include: 

• Special tools for mission-survival contingency repairs such as soldering, 
metal cutting, and drilling, as determined from contingency maintenance 
analyses, although repairs of this type are not considered routine main- 
tenance methods. 

• Protective clothing or protective work areas for planned hazardous 
maintenance tasks (such as those involving fuels, etc. ). 

• Automated maintenance procedures and stock location data for both 
scheduled and unscheduled maintenance and repair activities. 

• Real-time ground communication of the detailed procedures, update 
data, and procedures not carried onboard. 

• Onboard cleanroom-type conditions by "glove box" facilities compatible 
with the level at which this capability is found to be required. 

• Maintenance support stockrooms or stowage facilities for spares 
located in an area that provides for ease of inventory control and 
ready accessibility to docking locations or transfer passages. 

7. 1. 3 SUBSYSTEM MAINTENANCE CONCEPTS 

Space Station subsystems utilize modular concepts in design and emplace- 
ment of subsystem elements. Subsystem modularity enhances man's ability to 
maintain, repair, and replace elements of subsystems in orbit. Providing an 
effective onboard repair capability is essential in supporting the Space Station's 
ten-year life span since complete reliance on redundancy to achieve the long life 
is not feasible. The need for a repair capability, in turn, requires that a mal- 
function be isolated to at least its in-place remove-and-replace level. The level 
of fault isolation is keyed to the LRU, which is the smallest modular unit suitable 
for replacement. The identification of subsystem LRUs is addressed as a 
separate, but interdependent, part of the Onboard Checkout Study. 
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Specific subsystem maintenance concepts, of course, depend upon examina- 
tion of the subsystems. These concepts are discussed in subsequent subparagraphs. 
General subsystem -related maintenance guidelines that have been established for 
the Space Station are: 

• It is an objective to design so that EVA is not required. However, EVA 
may be used to accomplish maintenance/repair when no other solution 
is reasonable. 

• Subsystems will be repaired in an in-place configuration at a level that 
is acceptable for safety and handling, and that can be fault -isolated and 
reverified by the integrated OCS/DMS. This level of maintenance is 
referred to as line maintenance and the module replaced to effect the 
repair is the LRU. 

• A limited bench-level fault isolation capability will be provided on the 
Space Station, but is only intended for contingency (recovery of lost 
essential functions beyond the planned spares level) or for development 

purposes. Limited bench-level support is also provided in the form 
of standard measurement capabilities which are used primarily to 
reduce the amount of special test equipment required. 

• Subsystem elements, wherever practical, will be replaced only at 
failure or wearout. Limited-life items that fail with time in a manner 
that can be defined by analysis and test will be allowed to operate until 
they have reached a predetermined level of deteriorated performance 
prior to replacement. Where subsystem downtimes for replacement or 
repair exceed desirable downtimes, the subsystem will include backup 
(redundant) operational capability to permit maintenance. Expendable 
items (filters, etc. ) will be replaced on a preplanned, scheduled basis. 

7.2 ONBOARD ELECTRONIC MAINTENANCE (STUDY TASK 3) 

The objective of this task was to generate recommendations of supporting 
research and technology activities leading to implementation of a manned electron- 
ics maintenance facility for the Space Station. Early in the task it became apparent 
that attention could not be confined to a central maintenance facility; it was neces- 
sary to refocus the task to address implementation of an on-board maintenance 
capability encompassing in-place as well as centralized maintenance activities. 

The critical questions are the following: 

• What is the optimum allocation of onboard maintenance functions 
between in-place and centralized maintenance facility locations? 
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• What is the optimum level of onboard repair (i. e. , to line-replaceable 
unit, subassembly or module, piece part, or circuit element)? 

7.2.1 MAINTENANCE CYCLE 

In order to place the task in the proper context, a generalized Space Station 
electronic maintenance cycle is depicted in Figure 7-1. 

A convenient place to enter the cycle is with detection of a fault ("In-Place 
Maintenance" block). The fault is isolated to a Line Replaceable Unit (LRU). The 
affected subsystem is restored to full capability by replacing the failed LRU with an 
operable one from spares storage. 

The failed LRU is taken to a maintenance facility (assumed for the moment 
to have a fixed location in the Space Station) where it is first classified. as repair- 
able or non-repairable. Classifications will likely be predetermined, and a listing 
should be retained in the Data Management Subsystem. If the LRU is non-repairable, 
it is placed in segregated storage. If the LRU is repairable on board, the fault is 
further isolated to the failed Shop Replaceable Assembly (SRA). The LRU is then 
repaired by replacing the failed SRA with one from spares storage. The repaired 
LRU is then calibrated (if necessary), and its operation verified before it is placed 
in spares storage. 

Logistics requirements (replacement LRUs and SRAs needed) are transmitted 
to ground-based logistics support functions by RF communications and/or Space 
Shuttle. Failed units are taken away from and replacement units are delivered to 
the Space Station by the Space Shuttle. 

7. 2. 2 SUMMARY OF RESULTS 

The study confirmed and emphasized the necessity of onboard maintenance for 
any manned mission of any complexity and duration measured in months (up to 10 
years for Space Station). Formulation of recommendations for implementing such 
a capability required consideration of other topics first, and achievement of 
certain interim results. The principal conclusions of this study task are sum- 
marized below. The analyses leading to them are explained in the Task 3 Final 
Report. 

• Prior studies and developments of in-space maintenance have empha- 
sized justification of first-level (in-place) maintenance, fasteners, and 
tools for space application and human factors criteria. Much less 
attention has been devoted to test equipment, maintenance training, or 
definition of shop level maintenance requirements. 
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Figure 7-1. Space Station Maintenance Cycle 

• The baseline subsystem descriptions, checkout requirements analysis, 
and software requirements analysis indicate that approximately 60 per- 
cent of all faults (over a long period) can be isolated to the failed LRU 
automatically under software control, without crew intervention. In an 
additional 27 percent of failure cases, fault isolation to one LRU can be 
achieved by the crew using the onboard Data Management System as a 
tool. In the remaining failure cases, additional fault isolation capabili- 
ties are needed. This is a good result for a "first iteration" and can 
probably be improved considerably with a modest effort to modify stim- 
ulus and measurement provisions. 

• Crew involvement in scheduled and unscheduled maintenance (including 
participation in fault isolation) is estimated to average 7. 2 manhours per 
week over the total mission time. This estimate is most sensitive to 
equipment reliability and levels at which onboard repair is performed. 

It is affected little by the efficiency of automated fault isolation under 
control of the Data Management Subsystem (DMS). 
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• The recommended approach to maintenance in the baseline Space Station 
is in-place removal and replacement of LRUs, without attempts to repair 
LRUs onboard, if the resupply interval is less than nine months. Onboard 
spares should be LRUs. 

• For long resupply intervals or non-resupplied missions (as in a manned 
interplanetary mission), in-place maintenance should be by removal and 
replacement of LRUs. Repair of LRUs should be by removal and replace- 
ment of Shop Replaceable Assemblies (SRAs). Onboard spares should be 
SRAs. 

• The Earth-orbital Space Station should include provision for development 
of onboard maintenance capability and techniques applicable to long dura- 
tion non-resupplied missions and/or the larger, more complex Space 
Base. 

• The baseline subsystem descriptions are at such a level of detail that 
precise specification of onboard tools and test equipment is neither 
feasible nor desirable. Anticipated needs identified qualitatively in the 
study are: (1) a portable test module to supplement software fault isola- 
tion as well as to assist mechanical adjustments and calibrator, (2) hand 
tools for removal and replacement of electronic assemblies, (3) devices 
for transporting and positioning spare assemblies, and (4) a central 
maintenance/repair bench. 

• Several tasks have been identified and recommended for future perfor- 
mance, as part of a system study/design program or as separate 
supporting research and technology tasks. The principal ones deal with 
(1) development of a portable test assembly, (2) development of a repair/ 
test bench with special provisions for small parts retention and for de- 
bris collection, (3) design for accessibility of test points and subassem- 
blies, and (4) devices for transporting equipment within the Space Station. 

The foregoing conclusions apply to the Modular Space Station as well as the 
33-foot diameter, four-deck configuration. 

The results of the study rest upon several assumptions and estimates, 
derived wherever possible from related experience. The results are not sensitive 
to small variations of the assumed or estimated values, except for equipment fail- 
ure rates, which are most influential. Furthermore, it has not been practicable to 
pursue all trade analyses to include all relevant factors. Nevertheless, the study 
has generated valid insights into Space Station onboard maintenance and useful 
visibility of the path to implementation of that capability. 
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